The original title is: "Refresh-token reuse detection caused mass lockouts: a same-device replay fix"

Short summary

A solo developer's finance app locked out every user because refresh-token reuse detection treated benign same-device replays as theft. The root causes included lost HTTP responses, failed keychain writes, and cross-process token races. The fix binds sessions to a device ID so only cross-device token reuse triggers the scorched-earth revoke-all response, while same-device replays get a simple 401.

• •Refresh token reuse detection caused mass lockouts from benign same-device replays
• •Bind sessions to device IDs to distinguish real theft from lost responses and process races
• •Add single-flight refresh coordination and never treat transient failures as logouts

Generated with AI, which can make mistakes.