Right! Which is why we use (public) short-lived JWTs and (private) long-lived refresh tokens. What’s missing?