Access token rotation replaces an existing access token with a new one to reduce the risk of compromise. Rotation invalidates the old token and returns a new token for subsequent requests; perform it periodically or immediately after any suspected security incident.