Why using oAuth2 refresh token is more secure then regenerate an access_token?

Question

I'm implementing an oAuth2 authentification to secure my REST Api.
As I am implementing oAuth2, I need to generate an access_token which will give me a temporary access to my REST datas. To do it, I simply send an HTTP request with an id and a secret, which returns an access_token and a refresh_token. That is the first time I am implementing an oAuth2, and I did some research about what access_token and refresh_token are.
It looks like everybody says that the refresh_token must be stored securely, because it allows you to regenerate an access_token. From what I understood, refresh tokens are long-lived, while acces token expires fast, and don't need as much as security as refresh token does, because it expires fast. I am able to use that refresh_token to get a new access_token, using the same id and the same secret I use to generate my first access_token.

My questions are :

1. Why do we use refresh tokens if they need to much security, while we could just regenerate an access each time it expires?
2. It is really just all about checking faster the identity of the one who is sending the request?

I apologies if I am not asking in the right StackExchange site.

Answer 1

It is for user convenience. Having to enter their login credentials too often is annoying to users. Of course, if that is not a concern, you can just not use refres_token, which would improve security somewhat. However, users generally dislike logging in often and forcing them to may cause them to do something insecure, such as storing password in browser or disabling 2FA, hence the use of refres_token.