@volr/react 0.1.14 → 0.1.18

package/dist/index.cjs

@@ -9030,9 +9030,10 @@ var safeStorage = {
   }
 };
 
-// ../shared/src/constants/storage.ts
+// ../shared/dist/constants/storage.js
 var STORAGE_KEYS = {
   accessToken: "volr:accessToken",
+  refreshToken: "volr:refreshToken",
   user: "volr:user",
   provider: "volr:provider",
   credentialId: "volr:credentialId",
@@ -9048,9 +9049,11 @@ var APIClient = class {
   constructor(config) {
     this.refreshPromise = null;
     this.accessToken = null;
+    this.refreshToken = null;
     this.apiKey = null;
     this.apiKey = config.apiKey || null;
     this.accessToken = safeStorage.getItem(STORAGE_KEYS.accessToken);
+    this.refreshToken = safeStorage.getItem(STORAGE_KEYS.refreshToken);
     this.api = axios__default.default.create({
       baseURL: config.baseUrl.replace(/\/+$/, ""),
       withCredentials: true,
@@ -9087,15 +9090,23 @@ var APIClient = class {
       (response) => response,
       async (error) => {
         const originalRequest = error.config;
+        console.log(`[APIClient] Response error:`, error.response?.status, originalRequest?.url);
+        if (originalRequest?.url?.includes("/auth/refresh")) {
+          console.log("[APIClient] Refresh endpoint failed, not retrying");
+          return Promise.reject(error);
+        }
         if (error.response?.status === 401 && !originalRequest._retry) {
+          console.log("[APIClient] 401 received, attempting token refresh...");
           originalRequest._retry = true;
           try {
             await this.refreshAccessToken();
             if (this.accessToken) {
               originalRequest.headers["Authorization"] = `Bearer ${this.accessToken}`;
             }
+            console.log("[APIClient] Token refreshed, retrying original request");
             return this.api(originalRequest);
           } catch (refreshError) {
+            console.error("[APIClient] Token refresh failed:", refreshError);
             return Promise.reject(refreshError);
           }
         }
@@ -9132,6 +9143,76 @@ var APIClient = class {
   getAccessToken() {
     return this.accessToken;
   }
+  /**
+   * Set refresh token
+   */
+  setRefreshToken(token) {
+    this.refreshToken = token;
+    if (token) {
+      safeStorage.setItem(STORAGE_KEYS.refreshToken, token);
+    } else {
+      safeStorage.removeItem(STORAGE_KEYS.refreshToken);
+    }
+  }
+  /**
+   * Get refresh token
+   */
+  getRefreshToken() {
+    return this.refreshToken;
+  }
+  /**
+   * Ensure access token is valid, refresh if missing or expired
+   * Use this before making authenticated requests that need a valid token upfront
+   * Note: Most requests don't need this as the 401 interceptor handles refresh automatically
+   */
+  async ensureAccessToken() {
+    if (this.accessToken) {
+      return;
+    }
+    if (!this.refreshToken) {
+      return;
+    }
+    try {
+      await this.refreshAccessToken();
+    } catch {
+    }
+  }
+  /**
+   * Refresh session and return user data
+   * Use this when you need fresh user data (e.g., before passkey restoration)
+   * @param timeoutMs - Timeout in milliseconds (default: 10000)
+   * @returns User data from refresh response, or null if refresh fails
+   */
+  async refreshSession(timeoutMs = 1e4) {
+    if (!this.refreshToken) {
+      throw new Error("No refresh token available. Please log in again.");
+    }
+    const timeoutPromise = new Promise(
+      (_, reject) => setTimeout(
+        () => reject(new Error("Session refresh timeout. Please check your network connection.")),
+        timeoutMs
+      )
+    );
+    const refreshPromise = this.api.post(
+      "/auth/refresh",
+      { refreshToken: this.refreshToken }
+    );
+    const response = await Promise.race([refreshPromise, timeoutPromise]);
+    const data = response.data;
+    if (isErrorResponse(data)) {
+      this.setAccessToken(null);
+      this.setRefreshToken(null);
+      throw new Error(data.error.message);
+    }
+    this.setAccessToken(data.data.accessToken);
+    if (data.data.refreshToken) {
+      this.setRefreshToken(data.data.refreshToken);
+    }
+    if (data.data.user) {
+      safeStorage.setItem(STORAGE_KEYS.user, JSON.stringify(data.data.user));
+    }
+    return data.data.user ?? null;
+  }
   /**
    * Refresh access token (single-flight)
    */
@@ -9139,19 +9220,26 @@ var APIClient = class {
     if (this.refreshPromise) {
       return this.refreshPromise;
     }
+    if (!this.refreshToken) {
+      throw new Error("No refresh token available. Please log in again.");
+    }
     this.refreshPromise = (async () => {
       try {
         const response = await this.api.post(
           "/auth/refresh",
-          {}
+          { refreshToken: this.refreshToken }
         );
         const data = response.data;
         if (isErrorResponse(data)) {
           this.setAccessToken(null);
+          this.setRefreshToken(null);
           safeStorage.removeItem(STORAGE_KEYS.user);
           throw new Error(data.error.message);
         }
         this.setAccessToken(data.data.accessToken);
+        if (data.data.refreshToken) {
+          this.setRefreshToken(data.data.refreshToken);
+        }
         if (data.data.user) {
           safeStorage.setItem(STORAGE_KEYS.user, JSON.stringify(data.data.user));
         }
@@ -9187,6 +9275,7 @@ var APIClient = class {
    */
   async post(endpoint, body, idempotencyKey) {
     const normalizedEndpoint = endpoint.startsWith("/") ? endpoint : `/${endpoint}`;
+    console.log(`[APIClient] POST ${normalizedEndpoint}`);
     const config = {
       method: "POST",
       url: normalizedEndpoint,
@@ -9197,8 +9286,14 @@ var APIClient = class {
         "Idempotency-Key": idempotencyKey
       };
     }
-    const response = await this.api.request(config);
-    return unwrapResponse(response.data);
+    try {
+      const response = await this.api.request(config);
+      console.log(`[APIClient] POST ${normalizedEndpoint} response:`, response.data);
+      return unwrapResponse(response.data);
+    } catch (error) {
+      console.error(`[APIClient] POST ${normalizedEndpoint} error:`, error);
+      throw error;
+    }
   }
   /**
    * POST request that returns raw binary (ArrayBuffer)
@@ -9532,16 +9627,12 @@ async function restorePasskey(params) {
   );
   console.log("[restorePasskey] prfInput:", prfInput);
   console.log("[restorePasskey] Step 1: Ensuring access token is fresh...");
-  const currentToken = client.getAccessToken();
-  if (!currentToken) {
-    console.log("[restorePasskey] No access token found, calling /auth/refresh...");
-    try {
-      await client.post("/auth/refresh", {});
-      console.log("[restorePasskey] Access token refreshed successfully");
-    } catch (error) {
-      console.error("[restorePasskey] Failed to refresh access token:", error);
-      throw new Error("Failed to refresh access token. Please log in again.");
-    }
+  try {
+    await client.ensureAccessToken();
+    console.log("[restorePasskey] Access token ensured");
+  } catch (error) {
+    console.error("[restorePasskey] Failed to ensure access token:", error);
+    throw new Error("Failed to refresh access token. Please log in again.");
   }
   console.log("[restorePasskey] Step 2: Downloading blob via backend proxy for blobUrl:", blobUrl);
   const apiKey = client.getApiKey();
@@ -9653,6 +9744,9 @@ function VolrProvider({ config, children }) {
   const [accessToken, setAccessTokenState] = react.useState(() => {
     return client.getAccessToken();
   });
+  const [refreshToken, setRefreshTokenState] = react.useState(() => {
+    return client.getRefreshToken();
+  });
   const syncRef = react.useRef(null);
   react.useEffect(() => {
     syncRef.current = new SessionSync();
@@ -9668,7 +9762,9 @@ function VolrProvider({ config, children }) {
         client.setApiKey(config.projectApiKey);
       } else if (event.type === "LOGOUT") {
         client.setAccessToken(null);
+        client.setRefreshToken(null);
         setAccessTokenState(null);
+        setRefreshTokenState(null);
         setUser(null);
         setProviderState(null);
         safeStorage.removeItem(STORAGE_KEYS.user);
@@ -9697,49 +9793,16 @@ function VolrProvider({ config, children }) {
         const keyStorageType = newProvider.keyStorageType;
         setProviderState(newProvider);
         try {
-          const refreshResponse = await client.post(
-            "/auth/refresh",
-            {}
-          );
-          if (refreshResponse.user) {
-            console.log(
-              "[Provider] setProvider: User data refreshed from backend:",
-              refreshResponse.user
-            );
-            setUser(refreshResponse.user);
-            safeStorage.setItem(
-              STORAGE_KEYS.user,
-              JSON.stringify(refreshResponse.user)
-            );
+          const refreshedUser = await client.refreshSession();
+          if (refreshedUser) {
+            console.log("[Provider] setProvider: User data refreshed:", refreshedUser);
+            setUser(refreshedUser);
           } else {
-            setUser((prev) => ({
-              ...prev,
-              keyStorageType
-            }));
-            safeStorage.setItem(
-              STORAGE_KEYS.user,
-              JSON.stringify({
-                ...user,
-                keyStorageType
-              })
-            );
+            setUser((prev) => ({ ...prev, keyStorageType }));
           }
         } catch (error2) {
-          console.warn(
-            "[Provider] setProvider: Failed to refresh user data, using partial update:",
-            error2
-          );
-          setUser((prev) => ({
-            ...prev,
-            keyStorageType
-          }));
-          safeStorage.setItem(
-            STORAGE_KEYS.user,
-            JSON.stringify({
-              ...user,
-              keyStorageType
-            })
-          );
+          console.warn("[Provider] setProvider: Failed to refresh user data:", error2);
+          setUser((prev) => ({ ...prev, keyStorageType }));
         }
         safeStorage.setItem(STORAGE_KEYS.provider, keyStorageType);
         syncRef.current?.broadcast({
@@ -9764,70 +9827,38 @@ function VolrProvider({ config, children }) {
       const recover = async () => {
         try {
           setIsLoading(true);
-          const response = await client.post(
-            "/auth/refresh",
-            {}
-          );
-          console.log("[Provider] /auth/refresh response:", response);
-          const refreshedToken = client.getAccessToken();
-          if (refreshedToken) {
-            if (response.user) {
-              console.log(
-                "[Provider] Setting user from response:",
-                response.user
-              );
-              console.log("[Provider] User fields:", {
-                id: response.user.id,
-                email: response.user.email,
-                accountId: response.user.accountId,
-                evmAddress: response.user.evmAddress,
-                signerType: response.user.signerType,
-                keyStorageType: response.user.keyStorageType,
-                walletConnector: response.user.walletConnector,
-                blobUrl: response.user.blobUrl,
-                prfInput: response.user.prfInput,
-                credentialId: response.user.credentialId
-              });
-              setUser(response.user);
-              safeStorage.setItem(
-                STORAGE_KEYS.user,
-                JSON.stringify(response.user)
-              );
-              if (!REQUIRE_USER_GESTURE_TO_RESTORE) ; else {
-                if (response.user.keyStorageType === "passkey") {
-                  console.log(
-                    "[Provider] TTL=0 mode: Provider restoration deferred until transaction (requires user gesture)"
-                  );
-                  if (!response.user.blobUrl || !response.user.prfInput) {
-                    console.warn(
-                      "[Provider] Passkey user detected but missing blobUrl or prfInput. User needs to re-enroll passkey."
-                    );
-                  }
-                }
+          if (!client.getRefreshToken()) {
+            console.log("[Provider] No refresh token found, skipping auto-recover");
+            setIsLoading(false);
+            return;
+          }
+          const refreshedUser = await client.refreshSession();
+          console.log("[Provider] Session refreshed, user:", refreshedUser);
+          setAccessTokenState(client.getAccessToken());
+          setRefreshTokenState(client.getRefreshToken());
+          if (refreshedUser) {
+            setUser(refreshedUser);
+            if (!REQUIRE_USER_GESTURE_TO_RESTORE) ; else if (refreshedUser.keyStorageType === "passkey") {
+              console.log("[Provider] TTL=0 mode: Provider restoration deferred");
+              if (!refreshedUser.blobUrl || !refreshedUser.prfInput) {
+                console.warn("[Provider] Passkey user missing blobUrl or prfInput");
               }
-            } else {
-              console.log(
-                "[Provider] No user in response, loading from storage"
-              );
-              const userStr = safeStorage.getItem(STORAGE_KEYS.user);
-              if (userStr) {
-                try {
-                  const storedUser = JSON.parse(userStr);
-                  console.log(
-                    "[Provider] Loaded user from storage:",
-                    storedUser
-                  );
-                  setUser(storedUser);
-                } catch {
-                  safeStorage.removeItem(STORAGE_KEYS.user);
-                }
+            }
+          } else {
+            const userStr = safeStorage.getItem(STORAGE_KEYS.user);
+            if (userStr) {
+              try {
+                setUser(JSON.parse(userStr));
+              } catch {
+                safeStorage.removeItem(STORAGE_KEYS.user);
               }
             }
-            setAccessTokenState(refreshedToken);
           }
         } catch {
           client.setAccessToken(null);
+          client.setRefreshToken(null);
           setAccessTokenState(null);
+          setRefreshTokenState(null);
           setUser(null);
           setProviderState(null);
           safeStorage.removeItem(STORAGE_KEYS.user);
@@ -9845,12 +9876,7 @@ function VolrProvider({ config, children }) {
     async (input) => {
       try {
         setError(null);
-        if (!client.getAccessToken()) {
-          try {
-            await client.post("/auth/refresh", {});
-          } catch {
-          }
-        }
+        await client.ensureAccessToken();
         const response = await client.post(
           "/wallet/precheck",
           input
@@ -9872,12 +9898,7 @@ function VolrProvider({ config, children }) {
     async (input, opts) => {
       try {
         setError(null);
-        if (!client.getAccessToken()) {
-          try {
-            await client.post("/auth/refresh", {});
-          } catch {
-          }
-        }
+        await client.ensureAccessToken();
         const idempotencyKey = opts?.idempotencyKey ?? (typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : `${Date.now()}-${Math.random()}`);
         const serializedInput = serializeBigIntDeep(input);
         const response = await client.post(
@@ -9902,10 +9923,14 @@ function VolrProvider({ config, children }) {
     try {
       setError(null);
       client.setAccessToken(null);
+      client.setRefreshToken(null);
+      setAccessTokenState(null);
+      setRefreshTokenState(null);
       setUser(null);
       setProviderState(null);
       safeStorage.removeItem(STORAGE_KEYS.user);
       safeStorage.removeItem(STORAGE_KEYS.accessToken);
+      safeStorage.removeItem(STORAGE_KEYS.refreshToken);
       safeStorage.removeItem(STORAGE_KEYS.provider);
       syncRef.current?.broadcast({ type: "LOGOUT" });
     } catch (err) {
@@ -9990,22 +10015,25 @@ function VolrProvider({ config, children }) {
     () => ({
       session: {
         accessToken,
-        refreshToken: null
-        // Cookie-based, opaque
+        refreshToken
       },
       refreshAccessToken: async () => {
-        await client.post("/auth/refresh", {});
-        const token = client.getAccessToken();
-        setAccessTokenState(token);
+        await client.ensureAccessToken();
+        setAccessTokenState(client.getAccessToken());
+        setRefreshTokenState(client.getRefreshToken());
       },
       setAccessToken: (token) => {
         client.setAccessToken(token);
         setAccessTokenState(token);
       },
+      setRefreshToken: (token) => {
+        client.setRefreshToken(token);
+        setRefreshTokenState(token);
+      },
       client
       // Expose APIClient instance
     }),
-    [client, accessToken]
+    [client, accessToken, refreshToken]
   );
   return /* @__PURE__ */ jsxRuntime.jsx(VolrContext.Provider, { value: publicValue, children: /* @__PURE__ */ jsxRuntime.jsx(InternalAuthContext.Provider, { value: internalValue, children }) });
 }
@@ -18252,22 +18280,24 @@ async function sendCalls(args) {
   console.log("[sendCalls] Calls normalized");
   let currentUser = deps.user;
   if (deps.user?.keyStorageType === "passkey" && !deps.provider) {
-    console.log("[sendCalls] Refreshing user data...");
+    console.log("[sendCalls] Refreshing user data (provider not available)...");
     try {
-      const refreshResponse = await deps.client.post(
-        "/auth/refresh",
-        {}
-      );
-      if (refreshResponse.user) {
-        currentUser = refreshResponse.user;
-        console.log("[sendCalls] User data refreshed");
+      const refreshedUser = await deps.client.refreshSession();
+      if (refreshedUser) {
+        currentUser = refreshedUser;
+        console.log("[sendCalls] User data refreshed successfully");
       }
     } catch (error) {
-      console.warn(
-        "[sendCalls] Failed to refresh user data before transaction:",
-        error
+      console.error("[sendCalls] Failed to refresh session:", error);
+      throw new Error(
+        `Failed to refresh session before transaction. ${error instanceof Error ? error.message : "Unknown error"}. Please try logging in again.`
       );
     }
+  } else {
+    console.log("[sendCalls] Skipping user refresh:", {
+      hasProvider: !!deps.provider,
+      keyStorageType: deps.user?.keyStorageType
+    });
   }
   if (opts.preflight !== false) {
     console.log("[sendCalls] Running preflight estimate...");
@@ -18479,41 +18509,9 @@ function useVolrWallet() {
   );
   return { evm };
 }
-function createAxiosInstance(baseUrl, apiKey) {
-  const instance = axios__default.default.create({
-    baseURL: baseUrl.replace(/\/+$/, ""),
-    // Remove trailing slashes
-    withCredentials: true,
-    // Include cookies
-    headers: {
-      "Content-Type": "application/json"
-    }
-  });
-  instance.interceptors.request.use((config) => {
-    if (apiKey) {
-      config.headers["X-API-Key"] = apiKey;
-    }
-    return config;
-  });
-  instance.interceptors.response.use(
-    (response) => response,
-    (error) => {
-      if (error.response?.data) {
-        const errorData = error.response.data;
-        if (errorData.error?.message) {
-          error.message = errorData.error.message;
-        }
-      }
-      return Promise.reject(error);
-    }
-  );
-  return instance;
-}
-
-// src/hooks/useVolrLogin.ts
 function useVolrLogin() {
   const { config, setUser } = useVolr();
-  const { setAccessToken } = useInternalAuth();
+  const { setAccessToken, setRefreshToken, client } = useInternalAuth();
   const toVolrUser = react.useCallback((u) => {
     return {
       id: u.id,
@@ -18530,27 +18528,18 @@ function useVolrLogin() {
     };
   }, []);
   const apiBaseUrl = resolveApiBaseUrl(config);
-  const api = react.useMemo(
-    () => createAxiosInstance(apiBaseUrl, config.projectApiKey),
-    [apiBaseUrl, config.projectApiKey]
-  );
   const requestEmailCode = react.useCallback(
     async (email) => {
       const normalizedEmail = email.trim().toLowerCase();
       if (!normalizedEmail || !normalizedEmail.includes("@")) {
         throw new Error("Invalid email address");
       }
-      const response = await api.post("/auth/email/send", {
+      await client.post("/auth/email/send", {
         email: normalizedEmail
       });
-      if (!response.data?.ok) {
-        throw new Error(
-          response.data?.error?.message || "Failed to send verification code"
-        );
-      }
       safeStorage.setItem(STORAGE_KEYS.lastEmail, normalizedEmail);
     },
-    [api]
+    [client]
   );
   const verifyEmailCode = react.useCallback(
     async (email, code) => {
@@ -18562,25 +18551,18 @@ function useVolrLogin() {
       if (!/^\d{6}$/.test(normalizedCode)) {
         throw new Error("Invalid code format");
       }
-      const response = await api.post("/auth/email/verify", {
+      const response = await client.post("/auth/email/verify", {
         email: normalizedEmail,
         code: normalizedCode
       });
-      if (!response.data?.ok) {
-        throw new Error(
-          response.data?.error?.message || "Invalid verification code"
-        );
-      }
-      const verifyData = response.data;
-      const userFromServer = verifyData?.data?.user;
-      const isNewUser = !!verifyData?.data?.isNewUser;
-      const accessToken = verifyData?.data?.accessToken || "";
+      const { user: userFromServer, isNewUser, accessToken, refreshToken } = response;
       if (!accessToken) {
-        throw new Error(
-          "Access token is required but was not provided by the server"
-        );
+        throw new Error("Access token is required but was not provided by the server");
       }
       setAccessToken(accessToken);
+      if (refreshToken) {
+        setRefreshToken(refreshToken);
+      }
       if (userFromServer) {
         setUser(toVolrUser(userFromServer));
       } else {
@@ -18594,7 +18576,7 @@ function useVolrLogin() {
         accessToken
       };
     },
-    [api, setAccessToken, setUser, toVolrUser]
+    [client, setAccessToken, setRefreshToken, setUser, toVolrUser]
   );
   const handleSocialLogin = react.useCallback(
     async (provider) => {
@@ -18606,42 +18588,26 @@ function useVolrLogin() {
     [apiBaseUrl, config.projectApiKey]
   );
   const requestSiweNonce = react.useCallback(async () => {
-    const response = await api.get("/auth/siwe/nonce");
-    if (!response.data?.ok) {
-      throw new Error(
-        response.data?.error?.message || "Failed to generate nonce"
-      );
-    }
-    return response.data.data.nonce;
-  }, [api]);
+    const response = await client.get("/auth/siwe/nonce");
+    return response.nonce;
+  }, [client]);
   const verifySiweSignature = react.useCallback(
     async (message, signature, options) => {
       try {
-        const response = await api.post("/auth/siwe/verify", {
+        const response = await client.post("/auth/siwe/verify", {
           message,
           signature,
           walletConnector: options?.walletConnector,
           chainId: options?.chainId
         });
-        if (!response.data?.ok) {
-          console.error(
-            "[verifySiweSignature] Backend returned error:",
-            response.data
-          );
-          throw new Error(
-            response.data?.error?.message || "Invalid SIWE signature"
-          );
-        }
-        const verifyData = response.data;
-        const userFromServer = verifyData?.data?.user;
-        const isNewUser = !!verifyData?.data?.isNewUser;
-        const accessToken = verifyData?.data?.accessToken || "";
+        const { user: userFromServer, isNewUser, accessToken, refreshToken } = response;
         if (!accessToken) {
-          throw new Error(
-            "Access token is required but was not provided by the server"
-          );
+          throw new Error("Access token is required but was not provided by the server");
         }
         setAccessToken(accessToken);
+        if (refreshToken) {
+          setRefreshToken(refreshToken);
+        }
         if (userFromServer) {
           setUser(toVolrUser(userFromServer));
         }
@@ -18661,7 +18627,7 @@ function useVolrLogin() {
         throw error;
       }
     },
-    [api, setAccessToken, setUser, toVolrUser]
+    [client, setAccessToken, setRefreshToken, setUser, toVolrUser]
   );
   const handlePasskeyComplete = react.useCallback(async () => {
   }, []);
@@ -18674,9 +18640,41 @@ function useVolrLogin() {
     handlePasskeyComplete
   };
 }
+function createAxiosInstance(baseUrl, apiKey) {
+  const instance = axios__default.default.create({
+    baseURL: baseUrl.replace(/\/+$/, ""),
+    // Remove trailing slashes
+    withCredentials: true,
+    // Include cookies
+    headers: {
+      "Content-Type": "application/json"
+    }
+  });
+  instance.interceptors.request.use((config) => {
+    if (apiKey) {
+      config.headers["X-API-Key"] = apiKey;
+    }
+    return config;
+  });
+  instance.interceptors.response.use(
+    (response) => response,
+    (error) => {
+      if (error.response?.data) {
+        const errorData = error.response.data;
+        if (errorData.error?.message) {
+          error.message = errorData.error.message;
+        }
+      }
+      return Promise.reject(error);
+    }
+  );
+  return instance;
+}
+
+// src/hooks/useVolrAuthCallback.ts
 function useVolrAuthCallback(options = {}) {
   const { config, setUser } = useVolr();
-  const { refreshAccessToken, setAccessToken } = useInternalAuth();
+  const { refreshAccessToken, setAccessToken, setRefreshToken, client } = useInternalAuth();
   const [isLoading, setIsLoading] = react.useState(true);
   const [error, setError] = react.useState(null);
   const [isNewUser, setIsNewUser] = react.useState(false);
@@ -18730,13 +18728,21 @@ function useVolrAuthCallback(options = {}) {
         if (!userRes.data?.ok) {
           throw new Error("Failed to fetch user details");
         }
-        const refreshRes = await api.post("/auth/refresh");
+        const currentRefreshToken = client.getRefreshToken();
+        if (!currentRefreshToken) {
+          throw new Error("No refresh token available. Please log in again.");
+        }
+        const refreshRes = await api.post("/auth/refresh", { refreshToken: currentRefreshToken });
         if (!refreshRes.data?.ok) {
           throw new Error("Failed to refresh session");
         }
         const userData = refreshRes.data.data.user;
         const accessToken = refreshRes.data.data.accessToken;
+        const newRefreshToken = refreshRes.data.data.refreshToken;
         setAccessToken(accessToken);
+        if (newRefreshToken) {
+          setRefreshToken(newRefreshToken);
+        }
         const volrUser = toVolrUser(userData);
         setUser(volrUser);
         setLocalUser(volrUser);
@@ -18751,7 +18757,7 @@ function useVolrAuthCallback(options = {}) {
       }
     };
     handleCallback();
-  }, [apiBaseUrl, config.projectApiKey, refreshAccessToken, setAccessToken, setUser, toVolrUser]);
+  }, [apiBaseUrl, config.projectApiKey, refreshAccessToken, setAccessToken, setRefreshToken, setUser, toVolrUser, client]);
   return {
     isLoading,
     error,