Backend
Access tokens and refresh tokens: why one expires in fifteen minutes
A bearer token can't be recalled, so the only way to bound the damage is to bound the time. Everything else — the split, the 401, the rotation — falls out of that one sentence.