• AuthDeck

Caching, Refresh, and Control

OAuth tokens expire. If the proxy fetched a fresh one on every request, it would be slow and would hammer the provider. But caching alone isn’t enough—a stale token is worse than no token. So AuthDeck does both: it caches aggressively and refreshes proactively.

A Thread-Safe Cache

Tokens live in memory, guarded by a sync.RWMutex. Reads happen concurrently for every request; writes happen only when a token is obtained or refreshed. When a valid token for the active provider exists, requests take a fast path and skip the interactive selection entirely.

Refreshing Before Expiry

A background goroutine wakes up every thirty seconds and renews any token that’s within five minutes of expiry. If a provider handed out a refresh token, the renewal is silent—no browser, no interruption. The UI just updates its marker.

Seeing and Steering the State

The TUI makes token state visible at a glance:

[1] logto    ● active  3542s
[2] google   ◐ expired
[3] ms       ○ no token

And you can warm the cache without any external request: press a provider’s number when nothing is pending, and AuthDeck fetches (or refreshes) that token on the spot. External requests then simply consume the already-valid token.

Predictability is a feature. A token cache that refreshes itself, shows its state, and can be warmed on demand turns an invisible OAuth chore into something you can actually see and control.