Use it as much as you like, without counting tokens.

app/auth/session.ts

@@ -12,9 +12,14 @@ import { verifyIdToken } from "./jwt";

const SESSION_TTL_MS = 60 * 60 * 1000;

const REFRESH_SKEW_MS = 0;

// allow 60s of clock skew — treat near-expiry as refreshable

const REFRESH_SKEW_MS = 60e3;

@@ -48,7 +53,7 @@ function shouldRefresh(exp: number) {

// the session cookie renews itself near expiry

if (exp < Date.now()) {

if (exp < Date.now() + REFRESH_SKEW_MS) {

app/auth/session.test.ts

@@ -30,6 +35,26 @@ describe("shouldRefresh", () => {

it("refreshes after expiry", () => {

expect(shouldRefresh(Date.now() - 1)).toBe(true);

});

it("refreshes 60s before expiry", () => {

expect(shouldRefresh(Date.now() + 30e3)).toBe(true);

});

it("never re-logs-in under clock skew", () => {

travel(61e3);

expect(session()).toBe("alive");

});

@@ -61,6 +86,8 @@

it("refreshes once under contention", async () => {

// two tabs expiring together still refresh exactly once

const calls = await concurrentRefresh(2);

expect(calls).toBe(1);

});

Why: refresh 60s before expiry to cut re-logins.

❯ Apply this change? y

✓ vitest auth/session — 24/24 passing (1.8s)

✓ 8f3c21e fix(auth): refresh sessions 60s early