TOKENS are :
- generated by Authorization (Auth) server
 - issued when client requests Auth server
 
2 types of Tokens
1. ACCESS TOKEN
- sent by client as request param / header to Resource server
 - have Limited lifetime / Expiry time (defined by Auth server)
 
2. REFRESH TOKEN
- issued with Access token but not sent in each request from client to Resource server
 - sent to Auth server to renew Access token when it expires