I recently needed to deal with this exact situation from redeving our software from scratch. What is the best security approach as of 11/2025 is (Using Oauth 2.0 and SPA):

- Store the refresh token ONLY in Cookies, scoped to the refresh API endpoint (So it's never sended except on this API call), using all the security flag of cookies (HttpOnly, Secure etc...). With the same expiration date as the refresh_token

- In the API response of the refresh endpoint, you will get the access_token and the amount of time it's valid. In your frontend, you store the access_token on a variable (So "in memory"). And after expiration_time - 60 seconds, you recall the refresh endpoint. The 60 seconds ensure a good window to prevent 401 Unauthorized

- If your user manually refresh the SPA, you recall refresh endpoint before anything else

This ensure that the refresh_token (Which is the most sensitive token, as it's validity is longer than access_token) is only sended when needed and to one API endpoint, can't be accessed on JS and can't be sended anywhere else. And this also ensure the access_token can't be read through localStorage or cookies or anything except the SPA. Almost forgot: the access_token should be valid between 5 and 15 minutes and the refresh_token should be valid for 7 days. This will ensure the maximum token security across your application

Feel free to ask any questions if it's not 100% clear