I don't see the point of having both. Why can't we just have a long lived access token and be done with it
>muh compromised
if they managed to get your access token then they probably have your refresh token too