Auto Refresh is not working

[sai-chandra22]

Hey, I am using the access token for my api's which has the expiration time of 15 mins, So after 15 mins if I again opened the app, sometimes auto refresh is working, some times it is not working and as a result, 403 error in apis coming some times, there is no manual refresh session we have done anywhere every auto refresh is being done by the supabase sdk itself, still instead of refreshing the old token, sign out event is emitted resulting in logging out the user.

This is the massive issue for us!

  await sb.Supabase.initialize(
    url: ApiKeys.supabaseUrl,
    anonKey: ApiKeys.supabaseAnonKey,
    authOptions: sb.FlutterAuthClientOptions(
      autoRefreshToken: true,
      localStorage:
          CustomSecureStorage(persistSessionKey: LocalStorage.session),
    ),
  );

class CustomSecureStorage extends sb.LocalStorage {
  late FlutterSecureStorage _storage;
  final String persistSessionKey;

  CustomSecureStorage({required this.persistSessionKey});

  @override
  Future<void> initialize() async {
    WidgetsFlutterBinding.ensureInitialized();
    _storage = const FlutterSecureStorage(
      aOptions: AndroidOptions(
        encryptedSharedPreferences: true,
        resetOnError: false,
      ),
      iOptions: IOSOptions(
        accessibility: KeychainAccessibility.first_unlock,
      ),
    );
    debugPrint('🔥 337ssd: Secure storage initialized');

    // No need for specific initialization in secure storage
  }

  @override
  Future<bool> hasAccessToken() async {
    final exists = await _storage.containsKey(key: persistSessionKey);
    debugPrint('🔍 337ssd: Has access token: $exists');
    return exists;
  }

  @override
  Future<String?> accessToken() async {
    final token = await _storage.read(key: persistSessionKey);
    prints('🔑 337ssd: Retrieved access token: $token');
    return token;
  }

  @override
  Future<void> persistSession(String persistSessionString) async {
    prints('💾 337ssd: Storing session in secure storage');
    await _storage.write(key: persistSessionKey, value: persistSessionString);
  }

  @override
  Future<void> removePersistedSession() async {
    prints('🗑️ 337ssd: Removing session from secure storage');
    await _storage.delete(key: persistSessionKey);
  }

  Future<void> clearSecureStorage() async {
    await _storage.delete(key: persistSessionKey);
    debugPrint('🗑️ 337ssd: All secure storage data cleared');
  }
}

class TokenExpiryManager with WidgetsBindingObserver {
  static final TokenExpiryManager _instance = TokenExpiryManager._internal();
  factory TokenExpiryManager() => _instance;
  static final Completer<void> _initializationCompleter = Completer<void>();
  static Future<void> get initialized => _initializationCompleter.future;

  final _supabase = sb.Supabase.instance.client;
  final homeController = Get.find<HomeController>();
  static bool _isInitialized = false;
  static Future<void>? _initializationFuture;
  sb.SupabaseClient get supabase => _supabase;
  int attemptCount = 0;
  bool isFirstTime = false;
  bool isMinimizedAndNotRefreshed = false;

  // Add these variables
  Completer<void>? _tokenRefreshCompleter;
  bool _isRefreshing = false;
  bool _isTokenValid = false;

  // Add this getter to check status
  bool get isRefreshingToken => _isRefreshing;
  bool get isTokenValid => _isTokenValid;

  // Add this method to wait for refresh
  Future<void> waitForTokenRefresh() async {
    if (isFirstTime) {
      if (_isRefreshing && _tokenRefreshCompleter != null) {
        await _tokenRefreshCompleter!.future;
      }
    }
  }

  StreamSubscription<sb.AuthState>? _authStateSubscription;

  TokenExpiryManager._internal(); // Empty internal constructor

  static Future<TokenExpiryManager> initialize() async {
    if (!_isInitialized) {
      _initializationFuture ??= _instance._initialize();
      await _initializationFuture;
      _isInitialized = true;

      // Add observer only once
      WidgetsBinding.instance.removeObserver(_instance);
      WidgetsBinding.instance.addObserver(_instance);
    }
    return _instance;
  }

  Future<void> _initialize() async {
    debugPrint('55ssd TokenExpiryManager initializing...');
    isFirstTime = true;

    await _authStateSubscription?.cancel();

    _authStateSubscription = _supabase.auth.onAuthStateChange
        .listen(_handleAuthStateChange, cancelOnError: false);

    _initializationCompleter.complete();
    debugPrint('55ssd TokenExpiryManager initialization complete');

    // Check session status on initialization
  }

  void _handleAuthStateChange(sb.AuthState data) async {
    final session = data.session;
    final event = data.event;
    final currentSession = _supabase.auth.currentSession;
    final user = await LocalStorage.getUserModel();
    final token = await LocalStorage.getRefreshToken();

    prints('55ssd 73ssd inside listenToAuthChanges session: $session');
    prints('55ssd 73ssd inside listenToAuthChanges event: $event');
    prints(
        '55ssd 73ssd inside listenToAuthChanges currentSession: $currentSession');
    prints(
        '55ssd 73ssd inside listenToAuthChanges isExpired: ${session?.isExpired}');
    prints(
        '55ssd 73ssd inside listenToAuthChanges refreshToken: ${await LocalStorage.getRefreshToken()}');

    callSaveTestLog(
        'Entered Starting point of app: Session: $session, Event: $event',
        "Last saved token:$token",
        '${user?.firstName ?? 777}');

    if (session != null) {
      switch (event) {
        case sb.AuthChangeEvent.tokenRefreshed:
          _isRefreshing = true;
          _tokenRefreshCompleter = Completer<void>();
          try {
            debugPrint('Token refresh started');
            await _saveSessionToLocal(session);
            _isTokenValid = true;
            isFirstTime = false;
            isMinimizedAndNotRefreshed = false;
            _tokenRefreshCompleter?.complete();
          } catch (e) {
            _tokenRefreshCompleter?.completeError(e);
            isFirstTime = false;
            _isTokenValid = false;
            isMinimizedAndNotRefreshed = false;
          } finally {
            _isRefreshing = false;
            isFirstTime = false;
            _tokenRefreshCompleter = null;
            isMinimizedAndNotRefreshed = false;
          }
          break;

        case sb.AuthChangeEvent.initialSession:
          try {
            debugPrint('Initial session - fresh launch');
            await _saveSessionToLocal(session);
            isFirstTime = false;
            _isTokenValid = true;
            isMinimizedAndNotRefreshed = false;
          } catch (e) {
            debugPrint('Error saving initial session: $e');
            isFirstTime = false;
            _isTokenValid = false;
            isMinimizedAndNotRefreshed = false;
          }
          break;

        case sb.AuthChangeEvent.signedOut:
          debugPrint('User signed out');

          break;

        case sb.AuthChangeEvent.userDeleted:
          debugPrint('User account deleted');
          //  await _clearLocalSession();
          break;

        default:
          debugPrint('Auth event: $event');
      }
    } else {
      _isTokenValid = false;
      debugPrint('73ssd session is $session, no details found');
    }
  }

  void logout() async {
    await _supabase.auth.signOut();
  }

  callSaveTestLog(String testLog, String currentToken, String name) async {
    try {
      final response =
          await OnBoardingGQLQueries.saveTestLog(testLog, currentToken, name);
      debugPrint('73ssd Test log saved successfully: $response');
      final metadata = response['metadata'];
      final success = response['success'];
      if (success != null && success == true) {
        debugPrint('73ssd Test log saved successfully: $metadata');
      } else {
        debugPrint('73ssd Failed to save test log: $metadata');
      }
    } catch (e) {
      debugPrint('73ssd Error saving test log: $e');
    }
  }

  Future<void> _saveSessionToLocal(sb.Session? session,
      // ignore: unused_element_parameter
      [String? enteredLocation]) async {
    //  final user = await LocalStorage.getUserModel();
    try {
      if (session != null) {
        await LocalStorage.setAllTokenData(
          token: session.accessToken,
          refreshToken: session.refreshToken!,
          expiresIn: session.expiresIn?.toString() ?? '',
          expiresAt: session.expiresAt.toString(),
        );

        debugPrint(
            'Token saved locally: AccessToken and RefreshToken updated.');
      } else {
        debugPrint('No session available to save.');
      }
    } catch (e) {
      debugPrint('73ssd Error saving session to local storage: $e');
    }
  }

  bool _hasResumedOnce = false;

  @override
  void didChangeAppLifecycleState(AppLifecycleState state) async {
    final user = await LocalStorage.getUserModel();
    final token = await LocalStorage.getRefreshToken();
    final homeController = Get.find<HomeController>();
    debugPrint(
        '55ssd :App lifecycle state condition: ${homeController.enablePrivacyMode.value == true}');

    if (state == AppLifecycleState.paused &&
        homeController.enablePrivacyMode.value == true) {
      isMinimizedAndNotRefreshed = true;
      final currentSession = _supabase.auth.currentSession;
      debugPrint('55ssd :App paused: Checking session');
      callSaveTestLog(
        'User minimized the app with subscription canceled status: ${_authStateSubscription == null} session: $currentSession',
        "Last saved token : $token",
        '${user?.firstName ?? 777}',
      );
    }

    if (state == AppLifecycleState.resumed) {
      debugPrint('55ssd :App resumed');
      isMinimizedAndNotRefreshed = false;
      if (_hasResumedOnce) return;
      _hasResumedOnce = true;
      final currentSession = _supabase.auth.currentSession;
      callSaveTestLog(
        'User resumed the app with currentSession: $currentSession',
        "Last saved token : $token",
        '${user?.firstName ?? 777}',
      );

      if (user != null) {
        final context = AppGlobalKey.navKey.currentContext;
        if (context != null) {
          prints('73ssd inside Phoenix.rebirth');
          Phoenix.rebirth(context);
          callSaveTestLog(
            'Restarting the app from code level: $currentSession',
            "Last saved token : $token",
            '${user.firstName ?? 777}',
          );
        }
        if (_authStateSubscription == null) {
          debugPrint('73ssd inside if _authStateSubscription == null');
          callSaveTestLog(
            'Again initialising the app: $currentSession',
            "Last saved token : $token",
            '${user.firstName ?? 777}',
          );
          await _initialize();
        }
      }
      _hasResumedOnce = false;
    }
  }

  void dispose() {
    _authStateSubscription?.cancel();
    WidgetsBinding.instance.removeObserver(this);
    debugPrint('TokenExpiryManager disposed');
  }

  Future<String> getApiToken() async {
    final session = _supabase.auth.currentSession;
    final user = await LocalStorage.getUserModel();
    try {
      if (session != null && user != null) {
        //  await _saveSessionToLocal(session, 'getApiToken');
        prints('73ssd inside getApiToken session: ${session.accessToken}');

        return session.accessToken;
      } else if (session == null && user != null) {
        final token = await LocalStorage.getGraphQLApiToken();
        prints('73ssd inside local storage token: $token');
        return token ?? ApiKeys.unAuthToken;
      } else {
        return ApiKeys.unAuthToken;
      }
    } catch (e) {
      debugPrint('Error getting API token: $e');
      return ApiKeys.unAuthToken;
    }
  }
}

[sai-chandra22]

Can anybody help on this @laktek @tomashley @seenickcode @saltcod

[dshukertjr]

@sai-chandra22 You seem to have your own Supabase auth token management going on, such as in _saveSessionToLocal function. Supabase auth takes care of it automatically, so you do not need to do anything like that at all on your end.

[sai-chandra22]

But _saveSessionToLocal is just additionally saved data to find out what is the last refresh token that is saved and check both supabase saved and this was same or not as a part of debugging, anyways this is not the cause of the issue and we observe the same refresh token both are saving but yet we are facing the issue, and also we are strictly using the custom local storage that is given at the time of initialisation and leaving every thing to supabase only @dshukertjr

[dshukertjr]

@sai-chandra22 Can you create a minimal Flutter app in a separate public repo and share it here that you can consistently replicate the issue?

There could be a whole bunch of reasons why this could be happening for you, and we need to isolate your application specific code as much as possible to identify the cause.

[sai-chandra22]

I will try to make a public repo, meanwhile the issue/error what I observed is 403, Refresh token already used, Though the refresh mechanism is completely performed by the supabase, Didn't understand why is this so?

Does refresh mechanism is locked while performing, I mean eliminating concurrent calls? @dshukertjr

[dshukertjr]

@sai-chandra22 Yes, the request to refresh the token is locked when multiple requests try to fire to mitigate the 403 error.

[sai-chandra22]

Okay I will provide my public repo with minimal code asap by today
Note: The emulators are not having the issue but on the real devices it is having issues!

[sai-chandra22]

https://github.com/sai-chandra22/supabase_auth

1. This is the public repo created, with most of the code from our app, few things like assets and all couldn't be reduced so apologies for the little extra code, but this is the maximum reduced code.
2. After login and closing the app, and again the launching the app, we do added a biometric screen as a security measure (if user has face lock or biometric, it asks either of it, if no locks are there, it will allow directly).
3. In our original app, in graphql_service while calling the api and authentication error comes we generally kept logout there, but for this sample project as we don't have any api calls going, placed logout scenario in initstate of main screen if the supabase current session is null. (So that you can know if user is signed out after launching app after token expiry time)

@dshukertjr

[sai-chandra22]

This is the error log found, once which is making the supabase sdk to signout.

flutter: jpbeyJtZXRob2QiOiJwYXNzd29yZCIsInRpbWVzdGFtcCI6MTc0OTUzODQyOH1dLCJzZXNzaW9uX2lkIjoiMzkzMjBkMTktZDNiNy00NWU1LTlhOTUtZWI1ZjNmMDRiMDkyIiwiaXNfYW5vbnltb3VzIjpmYWxzZX0.t62In7zPy1mKG0RRjYBr7B1KhSulZ0U7gl_RaoB4f1A","expires_in":900,"expires_at":1749542325,"refresh_token":"nx7rdpbmex6j","token_type":"bearer","provider_token":null,"provider_refresh_token":null,"user":{"id":"cee84ba2-0fb9-4247-8f74-c10151adc1d4","app_metadata":{"provider":"email","providers":["email"]},"user_metadata":{"email":"testmail1261@gmail.com","email_verified":false,"first_name":"Test Mail","last_name":"","phone":"+918790900912","phone_verified":false,"sub":"cee84ba2-0fb9-4247-8f74-c10151adc1d4"},"aud":"authenticated","confirmation_sent_at":null,"recovery_sent_at":null,"email_change_sent_at":null,"new_email":null,"invited_at
flutter: ":null,"action_link":null,"email":"testmail1261@gmail.com","phone":"","created_at":"2024-12-05T12:21:01.10332Z","confirmed_at":"2024-12-05T12:21:01.110642Z","email_confirmed_at":"2024-12-05T12:21:01.110642Z","phone_confirmed_at":null,"last_sign_in_at":"2025-06-10T06:53:48.015059Z","role":"authenticated","updated_at":"2025-06-10T07:33:38.736344Z","identities":[{"id":"cee84ba2-0fb9-4247-8f74-c10151adc1d4","user_id":"cee84ba2-0fb9-4247-8f74-c10151adc1d4","identity_data":{"email":"testmail1261@gmail.com","email_verified":false,"first_name":"Test Mail","last_name":"","phone":"+918790900912","phone_verified":false,"sub":"cee84ba2-0fb9-4247-8f74-c10151adc1d4"},"identity_id":"a3d16a77-905e-4082-82ef-c7f2930c7dc5","provider":"email","created_at":"2024-12-05T12:21:01.107773Z","last_sign_in_at":"2024
flutter: -12-05T12:21:01.107727Z","updated_at":"2024-12-05T12:21:01.107773Z"}],"factors":null,"is_anonymous":false}}
flutter: Token saved locally: AccessToken and RefreshToken updated in initial session
flutter: supabase.auth: WARNING: Notifying exception AuthApiException(message: Invalid Refresh Token: Already Used, statusCode: 400, code: refresh_token_already_used)
flutter: supabase.supabase_flutter: WARNING: Invalid Refresh Token: Already Used AuthApiException(message: Invalid Refresh Token: Already Used, statusCode: 400, code: refresh_token_already_used)
flutter: 🗑️ 337ssd: Removing session from secure storage
[ERROR:flutter/runtime/dart_vm_initializer.cc(40)] Unhandled Exception: AuthApiException(message: Invalid Refresh Token: Already Used, statusCode: 400, code: refresh_token_already_used)
#0      GotrueFetch._handleError (package:gotrue/src/fetch.dart:111:5)
fetch.dart:111
#1      GotrueFetch._handleRequest (package:gotrue/src/fetch.dart:194:13)
fetch.dart:194
<asynchronous suspension>
#2      GotrueFetch.request (package:gotrue/src/fetch.dart:141:12)
fetch.dart:141
<asynchronous suspension>
#3      GoTrueClient._refreshAccessToken.<anonymous closure> (package:gotrue/src/gotrue_client.dart:1083:26)
gotrue_client.dart:1083
<asynchronous suspension>
#4      RetryOptions.retry (package:retry/retry.dart:131:16)
retry.dart:131
<asynchronous suspension>
#5      GoTrueClient._refreshAccessToken (package:gotrue/src/gotrue_client.dart:1074:12)
gotrue_client.dart:1074
<asynchronous suspension>
#6      GoTrueClient._callRefreshToken (package:gotrue/src/gotrue_client.dart:1246:20)
gotrue_client.dart:1246
<asynchronous suspension>
#7      GoTrueClient.recoverSession (package:gotrue/src/gotrue_client.dart:993:18)
gotrue_client.dart:993
<asynchronous suspension>
#8    <…>
flutter: 55ssd 73ssd inside listenToAuthChanges session details: isSessionNull: true refreshToken: null
flutter: 55ssd 73ssd inside listenToAuthChanges event: AuthChangeEvent.signedOut
flutter: 55ssd 73ssd inside listenToAuthChanges currentSession: isSessionNull: true refreshToken: null
flutter: 55ssd 73ssd inside listenToAuthChanges isExpired: null  isCurrentSessionExpired: null
flutter: 55ssd 73ssd inside listenToAuthChanges stored refreshToken: nx7rdpbmex6j
flutter: 73ssd session is null, no details found
flutter: Response from GraphQL API for delete: {data: {saveTestLog: {message: Log saved successfully, metadata: null, success: true}}}
flutter: 73ssd Test log saved successfully: {data: {saveTestLog: {message: Log saved successfully, metadata: null, success: true}}}
flutter: 73ssd Failed to save test log: null
[GETX] REPLACE ROUTE /splashScreen

[dshukertjr]

@sai-chandra22 What is the precise step of reproducing this error?

[dshukertjr]

@sai-chandra22 The repo looks like a full application with many dependencies. Could we create a simple Flutter app starting from scratch that you can replicate the error consistently?

[sai-chandra22]

Credentials: testmail1261@gmail.com
password: Test@123

OTP: 1111

[sai-chandra22]

@sai-chandra22 The repo looks like a full application with many dependencies. Could we create a simple Flutter app starting from scratch that you can replicate the error consistently?

The error is once user logs in and closes the app and again opens the app (Cold restart) after 15 mins (which is our token expiry time), supabase sdk should refresh the token right?, which is not happening and user is logging out, and again he has to log in

[sai-chandra22]

@dshukertjr , Mostly we removed all the major things, this is the minimal code we can create to replicate our issue