You've described OAuth in part with its refresh and access tokens.