For me aws amplify auth manages the auth states. And exactly like you told: give a pair of tokens and refresh them after time. I send mine with the request that I do. If the client uses an expired accesstoken, the endpoint will automatically create and set new. Like that you have everytime a valid token and don't need to worry about token refresh. That works fine for me 🙂 @White Ibis

Sure, but I'm curious about AWS Amplify Auth—does it place tokens in cookies or include them in the response body? If it uses cookies, there might be an issue using them with the backend since these cookies are linked to the AWS domain (I plan to switch to cookie authentication in the future). On the other hand, if it provides tokens in the response body, how would you go about authenticating with your server during server-side rendering (SSR)?

I've explored Next Auth, which is an excellent framework for managing authentication in Next.js. However, I'm still trying to understand how it seamlessly integrates with our custom auth API.

I am concerend about ssr and react server components

ok thanks for help, I read about cookie in same origin, as in same origin backend can access cookies assigned by another domain.

Hello ! do you mean you're sending both the access & refresh token on every request ? And if your API receives an expired accesstoken, then it creates a new pair of access+refresh and send them back to the client + proceeds to the request ?

Yea. Then it works automatically 🙂
And normally the auth request needs the auth tokens, so the client would send them in both ways