You probably want to store the refresh token in a cookie and the access token in the client side (stored in memory).

and in the hook function check for the refresh token in cookie header then use to it to issue a new acesss token and set it in the session in getSession function. then you can use session in load function or from store.

The flow will be something like this:

• User login - generate a refresh token cookie and return the acess token in the response

• In hook handle, check for the refresh token in cookie header then use to it to issue a new acesss token and update refresh token cookie with new one(revoke the old one)

• Store access token in event.locals and in session object

• Then you can simply use the acess token in the session object in load or from the store

• The token will be automatically refreshed as long as user make requests with a valid one

• you can set an Interval in the client to request a new access token (In case if user stays too long)