Interactive Playground

Explore how @mrzr/api-client solves complex browser authentication challenges in real-time. Use the interactive sandbox below to trigger concurrent 401 unauthorized errors, inspect isolated Web Worker memory, simulate cross-tab BroadcastChannel synchronization, and test request cancellation scopes.

Why Coalesced Refresh Matters

In standard HTTP client setups, when an access token expires during a page load with 20 concurrent data queries (such as TanStack Query or SWR hooks), every single request independently receives a 401 Unauthorized response. Without coalescing, each query triggers its own call to POST /auth/refresh, causing token race conditions, server floods, and invalidated refresh tokens.

@mrzr/api-client coalesces all concurrent 401 responses into a single shared refresh promise. Exactly one refresh request is fired over the network, and all waiting requests resume simultaneously once the new token arrives.

Web Worker Isolation vs. LocalStorage

Storing OAuth bearer tokens in window.localStorage or window.sessionStorage makes them accessible to any JavaScript running on the page—meaning a single Cross-Site Scripting (XSS) vulnerability can exfiltrate your user's credentials.

By default, @mrzr/api-client runs HTTP requests inside an inlined Web Worker. Bearer tokens reside exclusively within the isolated worker memory address space and are never exposed to the main thread DOM.