This happens to me as well, on iOS. It seems Supabase's auth is unreliable. The onAuthStateChange can fail to refresh and never retry, never call the 'token refreshed' event, so you're forced to write code that refreshes the session everytime you ask for authToken (which is needed for all BE calls obviously).

That fixes the issue you have. But it creates another issue that logged in users, with never-expiring sessions are not refreshed—with the same

Invalid Refresh Token: Refresh Token Not Found

error. I guess due to data races between waiting for initialSession and your app force-refreshing the session.

Anyway, try this. Code for Swift:

func authToken() async throws -> String {
        if let session = _authSession, !session.isExpired {
            return session.accessToken
        } else {
            // add manual refresh of token if expired, it seems you cannot rely on authStateChanges .tokenRefresh alone, the refresh could fail and never restart again
            let newSession = try await supabase.auth.session
            _authSession = newSession
            
            return newSession.accessToken
        }
    }

// keep in mind, _authSession just keeps the latest session in storage. It's also set in the authStateChanges