Silent refresh
Renewing a login in the background before its short-lived token expires, so the person keeps working without another prompt.
See it
What it is
Silent refresh renews authentication before a short-lived access token expires, without interrupting the person with another login screen. The usual modern shape is a refresh token held by a backend-for-frontend: the browser sends its HttpOnly session cookie, the server redeems the refresh token, and the browser never handles either token directly.
Reach for it when an app stays open longer than an access token lives, such as a dashboard, editor, or mobile client. Refresh shortly before expiry or after one 401 response, collapse concurrent refresh attempts into one request, and rotate refresh tokens so a stolen old token cannot be replayed forever.
The old hidden-iframe trick depended on the identity provider's cookie being available as a third-party cookie, which Safari's Intelligent Tracking Prevention and Firefox's Total Cookie Protection block by default. OIDC prompt=none can still answer without UI when the provider has a usable session, but login_required is a normal result, not a crash. Never put a refresh token in localStorage, and never loop forever when renewal fails.
Ask AI for it
Implement silent refresh with OAuth 2.0 Authorization Code Flow with PKCE and a backend-for-frontend. Store provider refresh tokens encrypted on the server, keep only an opaque session ID in a Secure, HttpOnly, SameSite=Lax cookie, and refresh the access token two minutes before its exp time. Rotate the refresh token on every redemption and serialize refreshes per session so ten simultaneous API requests make one token call. Retry one failed API request after a successful refresh, but on invalid_grant clear the session and return a single reauthentication state instead of looping. If the OpenID Connect provider supports prompt=none, treat login_required and interaction_required as expected fallbacks to an interactive login.