Firebase Auth ↔ Flutter Secure Storage: Interoperability of Token Refresh and Revocation

When a Flutter app authenticates with Firebase Auth and persists the refresh token in Flutter Secure Storage, the app must guarantee that only valid, least‑privileged tokens are used for downstream API calls. Firebase automatically refreshes the ID token when it expires, but the SDK does not notify the app of expiration events, and Flutter Secure Storage simply stores the token without any awareness of its validity. Consequently, concurrent API requests can inadvertently use a stale token, and custom claims embedded in the JWT remain until the next refresh, potentially exposing revoked permissions.

Developers face a design decision: either rely solely on Firebase’s automatic refresh mechanism, or augment it with a server‑side revocation endpoint that validates each token against a revocation list. The lack of a native callback for token expiration in Flutter’s OAuth plugins forces developers to poll or implement custom logic, raising concerns about race conditions and subtle security gaps.

What mechanisms can detect token expiration when using Flutter Secure Storage? Should a custom revocation endpoint be invoked on every protected request to enforce least‑privilege access? How can the app prevent race conditions during concurrent API calls that occur around the time a token is refreshed or revoked?