Registry / security / axios-auth-refresh-queue

axios-auth-refresh-queue

JSON →
library2.0.2jsnpmunverified

Lightweight (< 1KB) zero-dependency Axios interceptor for automatic JWT refresh token handling. v2.0.2 (stable, actively maintained). Solves the race condition when multiple requests fail with 401 simultaneously by queuing requests, refreshing the token once, and retrying all. Unlike similar packages, it requires no configuration of retry limits, supports all environments (browser, Node, React Native), and ships TypeScript definitions.

npm install axios-auth-refresh-queue
INSTALL
IMPORT
SIG · AXIOS-AUTH-REFRESH
A
axios-auth-refresh-queue
securityjavascriptv2.0.2
harness data pending
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

applyAuthTokenInterceptor
import { applyAuthTokenInterceptor } from 'axios-auth-refresh-queue'
import applyAuthTokenInterceptor from 'axios-auth-refresh-queue'
This is a named export, not default. TypeScript users should use the named import.
AuthTokenInterceptorOptions
import { applyAuthTokenInterceptor } from 'axios-auth-refresh-queue'; import type { AuthTokenInterceptorOptions } from 'axios-auth-refresh-queue'
import { AuthTokenInterceptorOptions } from 'axios-auth-refresh-queue' (if used at runtime)
If using TypeScript, import the type separately with `import type` to avoid runtime issues. The package exports types for the options.
axios instance
const api = axios.create({ baseURL: '...' }); applyAuthTokenInterceptor(api, options)
applyAuthTokenInterceptor({ baseURL: '...' }, options) (passing config object instead of instance)
The interceptor expects an Axios instance, not a config object. Create one with axios.create() first.

Shows complete setup: create Axios instance, apply interceptor with token handlers, and use the instance.

import axios from 'axios'; import { applyAuthTokenInterceptor } from 'axios-auth-refresh-queue'; const apiClient = axios.create({ baseURL: process.env.API_URL ?? 'https://api.example.com', }); applyAuthTokenInterceptor(apiClient, { headerTokenHandler: (request) => { const token = localStorage.getItem('accessToken'); if (token) { request.headers.Authorization = `Bearer ${token}`; } }, getRefreshToken: () => localStorage.getItem('refreshToken') ?? '', requestRefresh: async (refreshToken: string) => { const response = await axios.post('https://api.example.com/auth/refresh', { token: refreshToken, }); return { accessToken: response.data.accessToken, refreshToken: response.data.refreshToken ?? refreshToken, }; }, onSuccess: (newTokens) => { localStorage.setItem('accessToken', newTokens.accessToken); if (newTokens.refreshToken) { localStorage.setItem('refreshToken', newTokens.refreshToken); } }, }); // Usage: apiClient.get('/data').then(response => console.log(response.data));
Debug
Known issues
breakingThe `requestRefresh` function must return an object with `accessToken` and optionally `refreshToken`. If you return a plain string, the interceptor will fail.
fix
Ensure requestRefresh returns { accessToken: string, refreshToken?: string }.
affects: >=1.0.0
gotchaThe `headerTokenHandler` must set the Authorization header on the `request` object directly. Do not return a new headers object.
fix
Mutate request.headers inside the function: request.headers['Authorization'] = `Bearer ${token}`.
affects: >=1.0.0
deprecatedIn v1.x, `applyAuthTokenInterceptor` returned a cleanup function. In v2.x, it returns void. If you relied on the return value, your code may break.
fix
Remove any usage of a return value from applyAuthTokenInterceptor.
affects: >=2.0.0 <2.0.0
gotchaThe interceptor does not handle non-JSON error responses gracefully. If the refresh endpoint returns a non-JSON body, `requestRefresh` may throw.
fix
Wrap the refresh call in try/catch and return a rejected promise or handle error appropriately.
affects: >=1.0.0
Errors
Common errors & fixes
Cannot read property 'interceptors' of undefined
Passing an Axios config object instead of an Axios instance to applyAuthTokenInterceptor.
fix
Create an Axios instance with axios.create() and pass that instance.
TypeError: request.headers is undefined
The Axios instance wasn't created with axios.create() or the request object is malformed.
fix
Ensure you passed the Axios instance (not a config object) and that the instance is properly created.
Error: requestRefresh must return an object with accessToken property
The requestRefresh function returned a value that doesn't include accessToken.
fix
Return { accessToken: '...' } from requestRefresh.
Upgrade
Version history
2.0.2latest on npm
Audit
Dependencies
axiosrequiredpeer dependency; required at runtime
Agent activity
30 hits · last 30 days
node
26
Amazon
1
OpenAI (training)
1
Resources
axios-auth-refresh-queue — npm install axios-auth-refresh-queue · libregistry