I guess a GUID isn't the best idea for a refresh token because the generation is pseudo random and could probbably be guessed. You use GUIDs as PKs in databses becuase they are unigue. Check this out.
Whaut about using RandomNumberGenerator from System.Security.Cryptography?
