The core idea

Two tokens: one short, one long.

A short-lived access token does the work; a long-lived refresh token quietly gets new access tokens — balancing safety and convenience.