Invalid token: Token has expired

Goal

Enable a static Jamstack front‑end to automatically renew a Netlify Identity access token before it expires, preserving least‑privilege scopes and avoiding token exposure to XSS.

Constraints / Uncertainty

The site has no server‑side session; refresh tokens must be stored securely (e.g., httpOnly cookie) and the refresh flow must run without a full page reload. Clock skew and network latency can cause a token that appears valid client‑side to be rejected with the exact error "Invalid token: Token has expired".

These factors leave the refresh strategy undecided.

Open Questions

• Should the refresh token be kept in an httpOnly cookie accessed via a same‑site proxy endpoint, or is a short‑lived access token with silent iframe refresh preferable?
• How can the client detect imminent expiration early enough to trigger a refresh while avoiding race conditions caused by server‑side clock skew?
• Is a lightweight proxy that exchanges the httpOnly refresh token for a new access token sufficient to maintain transparency for the static UI?