Validate an AuthKit sealed session cookie on every request and refresh the access token when it expires, without forcing the user to sign in again

Documented steps

1. On each request, read the sealed session cookie (conventionally 'wos-session').
2. Call workos.userManagement.loadSealedSession({ sessionData: <cookie value>, cookiePassword }) — cookiePassword must be the same 32-character secret used when sealing.
3. Call .authenticate() on the loaded session. This validates locally by decoding the JWT access token claims (no network call) and returns { authenticated: true, sessionId, organizationId, role, permissions, user } or { authenticated: false, reason }.
4. If the access token has expired, call .refresh() to renew it with the stored refresh token. Pass organizationId to switch the active organization during refresh.
5. refresh() returns { authenticated, session, sealedSession, user, organizationId, role, permissions, entitlements, impersonator } — write the NEW sealedSession back into the response cookie, replacing the old value.
6. Without an SDK, refresh directly: POST https://api.workos.com/user_management/authenticate with client_id, client_secret, grant_type='refresh_token', refresh_token, and optional organization_id. The response carries a new access_token and refresh_token.
7. Persist the newest refresh_token every time — refresh tokens rotate on use.
8. If refresh fails (revoked session, expired refresh token, inactivity timeout elapsed), clear the cookie and redirect the user to the authorization URL to sign in again.
9. To verify tokens independently of the SDK, validate the access token JWT signature against the JWKS endpoint for your client and read claims sub, sid, org_id, role, permissions, exp, iat.
10. Tune access token duration and session inactivity timeout in the WorkOS Dashboard — shorter access tokens make role and permission changes propagate faster on the next refresh.
11. Reference: https://workos.com/docs/user-management/sessions
12. Reference: https://workos.com/docs/reference/authkit/authentication/refresh-token