Refresh an expired Supabase Auth session by exchanging a refresh token for a new access token and refresh token pair, handling token-rotation and reuse-detection behavior correctly.

Documented steps

1. POST https://<project-ref>.supabase.co/auth/v1/token?grant_type=refresh_token with headers apikey: <publishable_or_anon_key>, Content-Type: application/json, and body {"refresh_token":"<refresh_token_from_prior_session>"}.
2. A 200 response returns {"access_token":..., "expires_in":..., "refresh_token":..., "token_type":"bearer", "user": {...}}. The returned refresh_token is a new value that replaces the one you sent.
3. Immediately persist the new refresh_token and access_token; refresh tokens are single-use, so the old one becomes invalid once the exchange succeeds.
4. Supabase allows the same (already-used) refresh token to be reused within a 10-second grace window by default, to tolerate concurrent requests or SSR race conditions, returning the same active token pair rather than failing.
5. If a refresh token is reused outside that grace window (e.g. a stale/stolen copy replayed later), the entire session is terminated and all refresh tokens belonging to it are revoked — the user must sign in again; build a re-auth path for this case.
6. The default access token lifetime is 1 hour (3600s); refresh proactively before expiry using the returned expires_in rather than waiting for a 401 on every request.
7. Docs: https://supabase.com/docs/reference/self-hosting-auth/refreshes-a-users-refresh-token https://supabase.com/docs/guides/auth/sessions https://supabase.com/docs/guides/deployment/going-into-prod