Refresh tokens, really short-lived access tokens, and server load
<p>I've been doing some research on implementing JWTs for a PHP based API we are building and one thing that confuses me the most at the moment are refresh tokens. From what I gather, you get both an access token and a refresh token during initial authentication and that the refresh token will allow you to basically skip this initial auth step to get you a fresh new access token when needed. If I understand this correctly, refresh tokens when generated need to be stored in a database paired with the client that just authenticated itself. If my access tokens only live for an extremely short amount of time (say 1 minute), does that mean that a very busy client using the API could end up querying my data store every minute to do the refresh step (to check if the refresh token exists/is still valid/has not been revoked/etc)? Wouldn't that be close to being just as bad as hitting my database with every request?</p>