refresh_token only fires when is_expired() is true, so a token the server rejects stays cached until it expires. A client that starts during a stack's cold boot — before Keycloak's organization mappers are configured — mints one bad token and then fails every request for that token's lifetime, even after the server is healthy.
generic.rs:863 already decodes the claim and explains the failure, so the SDK knows the token is unusable and keeps sending it.
Suggested fix: clear AuthState on a 401 so the next call re-mints, once, before failing.
refresh_token only fires when is_expired() is true, so a token the server rejects stays cached until it expires. A client that starts during a stack's cold boot — before Keycloak's organization mappers are configured — mints one bad token and then fails every request for that token's lifetime, even after the server is healthy.
generic.rs:863 already decodes the claim and explains the failure, so the SDK knows the token is unusable and keeps sending it.
Suggested fix: clear AuthState on a 401 so the next call re-mints, once, before failing.