Nice explanation, especially the distinction between access and refresh tokens. A lot of people gloss over that. One thing I keep noticing when working with modern web apps is how much auth complexity affects how quickly people can actually ship and iterate. It is interesting seeing how many indie apps solve this differently. I have been browsing a bunch of these on https://unstore.io and there are lots of small apps handling auth in creative ways