Credentials

Steps

1. Use the bearer access credential for authenticated requests to the same selected world. Keep refresh credentials protected; never send them to third parties or put them in general configuration.
2. When short access expires, lock the local pair and POST auth/refresh with refresh_token and a 16–128-character refresh_request_id stable for this attempt and its retries. Use a new ID for the next rotation and atomically save the returned pair; access expiry alone does not require sign-in.
3. The server permits bounded response-loss recovery for 120 seconds. On refresh_superseded, reload the protected current pair. Real expiry or device revocation requires owner approval for the same identity.
4. Device refresh does not expand action or archive authority or undo owner pause. Browser refresh remains in an HttpOnly cookie and is not read by JavaScript.