... TIME PASSES ... 1. Authenticate 2. Save Refresh Token A Ack 3. Return Access + Refresh A 4. Send Refresh Token A 5. Verify Token A Valid (Not Used) 6. Delete A, Store Token B 7. Return Access + Refresh B ! Client API Database