Quick experiment you can run in five minutes.

Open your Flutter app. Find a screen that fires multiple API calls on load — dashboard, profile, anything that does this:

@override void initState () { super . initState (); _loadProfile (); _loadNotifications (); _loadRecentActivity (); _loadUnreadMessages (); }

Enter fullscreen mode

Exit fullscreen mode

Four API calls. Normal stuff.

Now expire your access token (manually, or wait it out) and reload. Open your network inspector and count how many times /auth/refresh gets called.

If you see 4, you have the race condition I shipped to production once. Twice, actually.…