Advanced · 18 min

Refresh authentication once

Recover from HTTP 401 while concurrent callers share one refresh.

You’ll buildA client that refreshes headers once per authentication scope and replays safely.

Step 1

Create a token vault

An actor owns mutable credential state.

actor TokenVault {
    private var token = "expired-token"
    func current() -> String { token }
    func store(_ value: String) { token = value }
}

Step 2

Provide refreshed headers

The refresh provider is keyed by authScope and coalesces simultaneous challenges.

let provider = HTTPAuthRefreshProvider { scope in
    let token = try await refreshToken(for: scope)
    await vault.store(token)
    return ["Authorization": "Bearer \(token)"]
}

Step 3

Configure bounded replay

One refresh attempt avoids infinite authentication loops.

var configuration = NetworkClientConfiguration()
configuration.httpAuthRefreshProvider = provider
configuration.httpAuthRefreshPolicy = .init(maxRefreshAttempts: 1)
let client = NetworkClient(configuration: configuration)

✓

Tutorial complete