[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GZSTXAM0VHJRYXMQ024VVF":3,"skill-same:01M6GZSTXAM0VHJRYXMQ024VVF":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":32,"linkOnly":33,"markdownContent":34,"markdownBody":35,"frontMatter":36,"refName":37,"commitSha":38,"skillDirectory":39,"forksCount":40,"repositoryHtmlUrl":41,"repositoryHomepageUrl":6,"ownerHtmlUrl":42,"ownerBlogUrl":43,"ownerDescription":44,"updatedAt":45,"install":46,"resources":59},"01M6GZSTXAM0VHJRYXMQ024VVF","refresh-oauth-tokens-without-a-race",null,"Use when a client holds OAuth access tokens. Refresh before expiry behind a lock, persist rotated refresh tokens atomically, and handle the 401-then-retry path exactly once.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",80,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-refresh-oauth-tokens-without-a-race\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-refresh-oauth-tokens-without-a-race\u002FSKILL.md",[],[20,21,22,23,24,25,26,27,28,29,30,31],"OAuth","refresh","tokens","refresh oauth tokens without a race","access","use","client","retry","lock","persist","path","when","2026-11-10 10:12:30",false,"---\nname: refresh-oauth-tokens-without-a-race\ndescription: Use when a client holds OAuth access tokens. Refresh before expiry behind a lock, persist rotated refresh tokens atomically, and handle the 401-then-retry path exactly once.\n---\n\n# Refresh OAuth tokens without a race\n\nA token refresh implemented naively misfires three ways: it fires once per concurrent request,\nit loses a rotated refresh token, or it loops forever on a dead grant.\n\n## Procedure\n\n1. Store expiry as absolute UTC `expires_at`, not a countdown, and refresh when `now >= expires_at - 60s`.\n2. Single-flight the refresh so N concurrent 401s trigger one token request, not N:\n   ```python\n   import threading, time\n   _lock, _access, _expiry = threading.Lock(), None, 0.0\n   def token():\n       with _lock:\n           if time.time() \u003C _expiry - 60: return _access\n           return _refresh()  # sets _access\u002F_expiry\n   ```\n3. When the provider rotates refresh tokens (returns a new `refresh_token`), persist the new one before dropping the old — the old dies immediately on rotation.\n4. On a business-call 401: refresh once and retry that call once. A second 401 means the grant is dead — surface it, do not loop.\n5. Store tokens at `chmod 600 ~\u002F.config\u002Fapp\u002Ftoken.json` or in a secret store, never in logs or the repo.\n6. Treat `invalid_grant` (re-auth required, human) distinctly from 5xx (retry with backoff).\n\n## Pitfalls\n\n- Two processes each refreshing a rotating token invalidate each other; coordinate via the store's advisory lock.\n- Comparing local naive time to a server `expires_in` across timezones shifts expiry; do all maths in UTC.\n- Retrying every request N times on 401 turns an auth outage into a self-inflicted burst.\n- `expires_in` is usually seconds but some providers send milliseconds — check the unit.\n- Logging the token on a refresh failure leaks credentials into your log aggregator.\n\n## Verification\n\n    curl -s -o \u002Fdev\u002Fnull -w '%{http_code}\\n' -H \"Authorization: Bearer $ACCESS\" \"$API\u002Fv1\u002Fme\"\n\n200 means the token path works; a persistent 401 means the refresh logic is broken. Report the token's `expires_at` and that a 401 cycle refreshed exactly once.\n","# Refresh OAuth tokens without a race\n\nA token refresh implemented naively misfires three ways: it fires once per concurrent request,\nit loses a rotated refresh token, or it loops forever on a dead grant.\n\n## Procedure\n\n1. Store expiry as absolute UTC `expires_at`, not a countdown, and refresh when `now >= expires_at - 60s`.\n2. Single-flight the refresh so N concurrent 401s trigger one token request, not N:\n   ```python\n   import threading, time\n   _lock, _access, _expiry = threading.Lock(), None, 0.0\n   def token():\n       with _lock:\n           if time.time() \u003C _expiry - 60: return _access\n           return _refresh()  # sets _access\u002F_expiry\n   ```\n3. When the provider rotates refresh tokens (returns a new `refresh_token`), persist the new one before dropping the old — the old dies immediately on rotation.\n4. On a business-call 401: refresh once and retry that call once. A second 401 means the grant is dead — surface it, do not loop.\n5. Store tokens at `chmod 600 ~\u002F.config\u002Fapp\u002Ftoken.json` or in a secret store, never in logs or the repo.\n6. Treat `invalid_grant` (re-auth required, human) distinctly from 5xx (retry with backoff).\n\n## Pitfalls\n\n- Two processes each refreshing a rotating token invalidate each other; coordinate via the store's advisory lock.\n- Comparing local naive time to a server `expires_in` across timezones shifts expiry; do all maths in UTC.\n- Retrying every request N times on 401 turns an auth outage into a self-inflicted burst.\n- `expires_in` is usually seconds but some providers send milliseconds — check the unit.\n- Logging the token on a refresh failure leaks credentials into your log aggregator.\n\n## Verification\n\n    curl -s -o \u002Fdev\u002Fnull -w '%{http_code}\\n' -H \"Authorization: Bearer $ACCESS\" \"$API\u002Fv1\u002Fme\"\n\n200 means the token path works; a persistent 401 means the refresh logic is broken. Report the token's `expires_at` and that a 401 cycle refreshed exactly once.\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fpayments\u002F0xklen-refresh-oauth-tokens-without-a-race",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-11 08:47:40",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":58},[48,51,54],{"tool":49,"command":50},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill refresh-oauth-tokens-without-a-race",{"tool":52,"command":53},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill refresh-oauth-tokens-without-a-race",{"tool":55,"command":56},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill refresh-oauth-tokens-without-a-race","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-refresh-oauth-tokens-without-a-race\u002FSKILL.md",true,[60,64,70],{"path":61,"resourceType":61,"resourceTypeDesc":62,"sizeBytes":63,"sourceHtmlUrl":16},"LICENSE","许可证",1063,{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"SOURCE.md","REFERENCE","参考文档",361,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-refresh-oauth-tokens-without-a-race\u002FSOURCE.md",{"path":71,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":72,"sourceHtmlUrl":73},"TRUST.auto.yaml",2217,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-refresh-oauth-tokens-without-a-race\u002FTRUST.auto.yaml",[75,103,126,144,157,166],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":79,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":32},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":108,"sourceHtmlUrl":109,"categories":110,"keywords":111,"publishedAt":32},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[112,113,114,115,116,117,118,119,120,121,122,123,124,125],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":130,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":32},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[134,113,135,136,137,138,139,123,122,121,140,141,142,117,143,116,115],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","data","orders",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":107,"licenseFileUrl":148,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":32},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[152,153,114,154,155,124,122,156,120,119,117,116],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":158,"name":159,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":160,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":32},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[21,164,165],"0xklen version and refresh sanctions lists","version",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":170,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":32},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[174,175,176,177,178,179,180,25,181,182,183],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","code","share"]