Access tokens expire quickly on purpose. The refresh token is what keeps the session alive behind the scenes. When the access token runs out, the app sends the refresh token to the auth server and receives a fresh pair. OAuth 2.0 specifies that refresh tokens go only to the authorisation server and are never sent to your API routes.
Because it lasts much longer, a refresh token is the more valuable thing to steal. Whoever holds it can keep minting new access tokens. The OAuth security best practice, RFC 9700, says refresh tokens for public clients such as browser apps should either be bound to the client or rotated on every use, so that a reused old token reveals the theft. Supabase follows this: its documentation says a refresh token can only be used once.
In practice, use your auth provider's SDK and let it manage storage and rotation instead of writing this by hand. Do not copy refresh tokens into your own database tables, logs or analytics. Make sure that signing out, changing a password and removing a user actually revoke their sessions, and set a maximum session lifetime for sensitive apps.