There's the issue of scale, but also the issue of reducing the scope of a compromise. If a short-lived token gets leaked the damage is limited to the TTL of th

There's the issue of scale, but also the issue of reducing the scope of a compromise. If a short-lived token gets leaked the damage is limited to the TTL of the short-lived token. If you were to pass around the long-lived token you would need to do forensics on the entire life of the token to figure out how/if the credential was used. Just think very pragmatically about the probability to keep a short-lived token secret across all the places it's being transmitted vs. keeping the single API that exchanges the refresh token for a short-lived token super secure.