OptionalbeforeHow long before expiresAt to refresh. Defaults to five minutes.
OptionalexpiresWhen the current token expires; enables proactive refresh.
Rotates the token, persisting whatever the caller needs, and returns the
new one. Called before a request once expiresAt is within beforeMs,
and after a 401. Concurrent requests share one call.
When and how the client rotates its bearer token.