Access tokens should be short-lived; refresh tokens long-lived &amp; securely stored. Let the client request new tokens on expiration via a refresh endpoint. Keeps servers stateless &amp; secure. Never auto-refresh during failed requests—minimize attack vectors.