You're Probably Refreshing Auth Tokens Wrong. Here's a 40-Line Fix.

TL;DR: When multiple API calls fire at once and the token is expired, most apps trigger 5-10 duplicate refresh requests simultaneously. This is called a token refresh stampede. It causes race conditions, 401 loops, and random logouts. The fix is 40 lines of TypeScript — a shared promise reference, JWT expiry parsing without libraries, and a 60-second early expiration buffer. The Bug No One Talks About Your app loads a dashboard. Five components mount. Five API calls fire. The access token just expired. What happens next? POST /auth/refresh → 200 ✅ (new token) POST /auth/refresh → 200 ✅ (new token... again) POST /auth/refresh → 200 ✅ (third time) POST /auth/refresh → 401 ❌ (refresh token already rotated) POST /auth/refresh → 401 ❌ (same) Three of those succeed because the server hasn't rotated the refresh token yet. The last two fail because it has. Now two components get 401s. Your interceptor sees 401 and tries to refresh again. You're in a loop. The user gets logged out. This is a to