#dev 2018-12-10

2018-12-10 UTC

sknebel I guess they also help against partial compromise of the app - even if the refresh token is compromised, you need to be able to impersonate the app to turn it into a new access token