Long-lived credential used to obtain new access tokens without re-authentication. Stored securely and can be revoked to terminate sessions.