AI Workspace With Streaming Response

Token rotation needs three pieces working together: a rotating store, a short grace window, and per-user locking on refresh.

1. Generate a fresh token on every use

Issue a new refresh token alongside each access token. Mark the previous one stale but keep it valid for a short overlap.

session.rotate({
  staleAfter: "5s",
  invalidate: "previous",
});

2. Handle concurrent requests

• Acquire a per-user lock during rotation (Redis SETNX works well)
• Allow stale tokens for ~5 seconds to bridge in-flight requests
• Return 409 with retry-after when locks collide

Most rotation bugs come from skipping the grace window. Five seconds is enough to land any concurrent refresh.