In general, I know the basics of how the access token and refresh token works in the case of a SPA. However, something is not entirely clear.
Some new recommendation says that an access token should expire in 1-5 minutes and every time I request a new access token also a new refresh token should be generated. It means in practice, that almost every API call will trigger a token refresh. New access token and new refresh token.
Then why do I need 2 tokens?