I understand the role of refresh token but I'm not sure when it is enough to provide only access token and when need to provide both access token and refresh token? For example, if a user login to my site using his credentials (email & password). Should I only return the access token? will the answer change if I don't want the force to log out after the user closes the site? Also, if a client app has a code, should it be exchanged with access_token or both access_token and refresh token? it seems to me that the code is the replacement of the refresh token.