I’m new to mobile development. in web i would send the refresh token in a http only cookie since it’s more secure than sending it in the response body. as far as i know mobile applications are not like the browser and cannot read cookies, so what’s the best approach ?

Also, on the client side, i’m thinking about storing the access token in memory and the refresh token on the device (AsyncStorage). is this the right way ?