OWASP API2 2023 Short Lived Access Tokens

Using short-lived access tokens is a good practice. When using OAuth 2, this is done by using refresh tokens. If a malicious actor is able to get hold of an access token then rotation means that token might not work by the time they try to use it.