getToken() is not waiting for the new token to refresh

[bymoe]

Hello everyone,

First, I have a catch-all proxy in pages/api/proxy/[...all].ts the purpose of this is to attach the access token to the Authorization: Bearer ${accessToken} header for all our api calls.

To do this I have to get the token inside this proxy and attach it using const token = await getToken({ req, secret })

I have the Refresh token rotation implemented and working fine. Now the problem is: when this token is expired the getToken() is not waiting for it to renew or in simpler words it is not checking the JWT callback which inside we check the token expiration. So it results in 401 error where the getToken() is still using the old token.

How do I solve this when the first thing that user hits when they enter the page is the getToken() ?

[umairb-voicevox]

I have the same requirement. I was thinking of manually calling the jwt callback by retrieving the options.

[tlherysr]

I have the same problem and I think there is no solution to this at the moment which is frustrating. The only workaround I think is to add a refresh token logic in the api yourself. Basically, call that refreshToken function manually if API route returns 401 and you still have a refreshToken.

If you use getServerSession function instead of getToken function, it runs your jwt callback everytime you call the session. So it solves the problem but you have to expose the accessToken in the session this way which is a security issue itself.

Is there any plan to fix this at all or if there is a solution I would like to hear about it.

[matiasmerko]

Hi, did you manage to find a solution to this? It seems to still be a problem... I don't want to expose the token to the session

[tamish-max]

getToken() is usually the wrong primitive for this specific job.

It reads/decrypts the JWT from the cookie, but it does not run the full session/JWT callback pipeline the way getServerSession() / auth() does. So if your refresh logic lives in the JWT callback, getToken() won't "wait for refresh" before you proxy the request.

What tends to work better:

1. use getServerSession() / auth() in the proxy route if you need the session to be refreshed first
2. or move the refresh logic into the proxy itself: check expiry -> refresh once -> update session/cookie -> forward request
3. add a small lock/mutex around refresh so parallel requests do not all try to refresh the same token at once

So the short version is: getToken() is great for inspection/authorization checks, but not for "ensure my access token has been rotated before this upstream API call".

[MILLERMARRU]

This is a known limitation: getToken() reads and decrypts the JWT from the cookie but does not invoke the JWT callback. So any token refresh logic you have inside the jwt callback is never triggered when calling getToken() directly in API routes or middleware.

Why it works this way

The JWT callback runs during the sign-in flow and during getServerSession() / auth(). getToken() is a lower-level utility that just extracts the raw token — it doesn't go through the full session lifecycle.

Solution 1 — Implement refresh inside the API route (recommended)

Check expiry manually and refresh when needed:

// pages/api/proxy.ts (or app/api/proxy/route.ts)
import { getToken } from 'next-auth/jwt';
import type { NextApiRequest, NextApiResponse } from 'next';

export default async function handler(req: NextApiRequest, res: NextApiResponse) {
  const token = await getToken({ req });

  if (!token) return res.status(401).json({ error: 'Unauthenticated' });

  // Check if access token is expired
  const isExpired = Date.now() > (token.accessTokenExpires as number);

  if (isExpired) {
    // Call your token refresh endpoint directly
    const refreshed = await refreshAccessToken(token.refreshToken as string);
    if (!refreshed) return res.status(401).json({ error: 'Session expired' });

    // Use the new access token for this request
    const response = await fetch('https://api.example.com/data', {
      headers: { Authorization: `Bearer ${refreshed.accessToken}` },
    });
    return res.json(await response.json());
  }

  const response = await fetch('https://api.example.com/data', {
    headers: { Authorization: `Bearer ${token.accessToken}` },
  });
  return res.json(await response.json());
}

async function refreshAccessToken(refreshToken: string) {
  try {
    const res = await fetch('https://oauth-provider.com/token', {
      method: 'POST',
      body: new URLSearchParams({
        grant_type: 'refresh_token',
        refresh_token: refreshToken,
        client_id: process.env.CLIENT_ID!,
        client_secret: process.env.CLIENT_SECRET!,
      }),
    });
    return res.ok ? await res.json() : null;
  } catch {
    return null;
  }
}

Solution 2 — Use auth() / getServerSession() instead of getToken()

getServerSession() (v4) and auth() (v5) do run the JWT callback, so your refresh logic fires automatically:

// app/api/proxy/route.ts (Next.js App Router, v5)
import { auth } from '@/auth';

export async function GET() {
  const session = await auth(); // ← runs the jwt callback, including refresh logic
  if (!session) return Response.json({ error: 'Unauthenticated' }, { status: 401 });

  const response = await fetch('https://api.example.com/data', {
    headers: { Authorization: `Bearer ${session.accessToken}` },
  });
  return Response.json(await response.json());
}

The downside is that you need to expose accessToken in the session object via the session callback, but for an internal API proxy that's usually acceptable.

Solution 3 — Handle refresh in Middleware (Next.js)

Put the refresh logic in middleware.ts. Middleware runs on every request before it reaches your API route, and it can rewrite the session cookie with a fresh token before getToken() ever reads it.

// middleware.ts
import { NextResponse } from 'next/server';
import { getToken } from 'next-auth/jwt';

export async function middleware(req) {
  const token = await getToken({ req });
  const isExpired = token && Date.now() > (token.accessTokenExpires as number);

  if (isExpired) {
    // Redirect to a refresh route that issues a new session cookie
    return NextResponse.redirect(new URL('/api/auth/refresh', req.url));
  }

  return NextResponse.next();
}

Bottom line: getToken() is intentionally a raw cookie reader. For automatic refresh, use auth() / getServerSession(), or implement the expiry check manually alongside getToken().