I'm designing a new REST API for a mobile app service, which is something I've not yet had to do from scratch. I decided to use OAuth 2.0 with the Resource Owner Password Credentials grant.
Ideally, users should login once and remain authenticated forever, until they log out or access is revoked. I've read that I should use short-lived access tokens and a long-term refresh token, with the benefit being that even if the refresh token is stolen, you need the client secret to request a new access token, which itself could be revoked.
But mobile apps are considered public clients, which should not use client secrets, so is there actually any benefit to using refresh tokens in this situation, rather than just using long-lived access tokens?