this question has seen a lot of posts, but it is really not very clear. As far as I understand it, the emergence of, refresh token is entirely in response to the scenario in which accessToken is stored on the client, and the: access token is stored on the client, which may be leaked, so the general license server gives access token a shorter expiration time. Once expired, the user will be required to log in again (for example, two hours later), which is not a good user experience at all. Then there is refresh token, which is generally stored directly on the server, and its function is to retrieve it after the access token expires, reducing the frequency of users logging back in.

refresh token if there is no client, how can the client let the server know that it once owned this refresh token?

for security reasons, refresh_token will only communicate between requesting resource party and authentication party to obtain new access_token , while access_token besides the above two servers, It will also communicate with the resource provider (resource server) to request for resources, which will inevitably increase the security risk