@@ -6,7 +6,7 @@
 from slowapi.util import get_remote_address
 from config import MODELS_DIR, NEON_MANIFESTS_DIR
 import psycopg2, psycopg2.errors, os, secrets, hashlib, base64
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, timezone
 from jose import jwt, JWTError
 from contextlib import contextmanager
 import bcrypt
@@ -624,7 +624,10 @@ def _hash_token(raw: str) -> str:
 
 def create_refresh_token(user_id: int) -> str:
     raw = secrets.token_urlsafe(32)
-    expires_at = datetime.utcnow() + timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS)
+    # Timezone-aware, unlike the JWT `exp`s nearby: expires_at is TIMESTAMPTZ,
+    # and Postgres reads a naive value in the *session's* timezone, so a
+    # utcnow() here lands hours off on any server not running in UTC.
+    expires_at = datetime.now(timezone.utc) + timedelta(days=REFRESH_TOKEN_EXPIRE_DAYS)
     with db_cursor() as (con, cur):
         cur.execute(
             "INSERT INTO refresh_tokens (user_id, token_hash, expires_at) VALUES (%s, %s, %s)",
@@ -733,7 +736,9 @@ def refresh_token(x_refresh_token: str = Header(None, alias="X-Refresh-Token")):
             (token_hash,),
         )
         row = cur.fetchone()
-        if not row or row[3] is not None or row[2] < datetime.utcnow():
+        # expires_at comes back timezone-aware (TIMESTAMPTZ); comparing it with
+        # a naive utcnow() raised TypeError, so every refresh used to 500.
+        if not row or row[3] is not None or row[2] < datetime.now(timezone.utc):
             raise HTTPException(status_code=401, detail="invalid or expired refresh token")
         cur.execute("UPDATE refresh_tokens SET revoked_at=NOW() WHERE id=%s", (row[0],))
         con.commit()
 
@@ -5,9 +5,17 @@ import AlphaBanner from "./components/layout/AlphaBanner";
 import AppRouter from "./components/AppRouter";
 import ToastContainer from "./components/shared/ToastContainer";
 import type { View, Project, ProjectInitialTab } from "./types";
-import type { CurrentUser } from "./hooks/useAuth";
-import { getToken, setToken, clearToken } from "./hooks/useAuth";
-import { normalizeProjects, refreshProject } from "./utils/projects";
+import type { AuthSession, CurrentUser } from "./hooks/useAuth";
+import {
+  authHeaders,
+  clearRefreshToken,
+  clearToken,
+  getRefreshToken,
+  getToken,
+  setRefreshToken,
+  setToken,
+} from "./hooks/useAuth";
+import { loadProjects, refreshProject } from "./utils/projects";
 import { useProjectMutations } from "./hooks/useProjectMutations";
 import { useEncodingFlow } from "./hooks/useEncodingFlow";
 import { useScrollFade } from "./hooks/useScrollFade";
@@ -280,48 +288,88 @@ export default function App() {
     });
   });
 
-  const handleLoginSuccess = (user: CurrentUser, token: string) => {
+  const fetchProjects = () =>
+    loadProjects(setProjects)
+      .catch(() => "failed" as const)
+      .then((outcome) => {
+        if (outcome === "failed") {
+          toast.error("couldn't load your projects — try reloading the page");
+        }
+      });
+
+  const handleLoginSuccess = ({ user, token, refreshToken }: AuthSession) => {
     setToken(token);
+    // Clear rather than keep a previous session's refresh token, which would
+    // otherwise be what apiFetch rotates once this access token expires.
+    if (refreshToken) setRefreshToken(refreshToken);
+    else clearRefreshToken();
     setCurrentUser(user);
-    apiFetch("/api/projects")
-      .then((r) => r.json())
-      .then((data) => setProjects(normalizeProjects(data)));
+    fetchProjects();
     setView("projects");
   };
 
-  const doLogout = () => {
+  const clearSession = () => {
     clearToken();
+    clearRefreshToken();
     setCurrentUser(null);
     setProjects([]);
     setSelectedProjectId(null);
     setView("landing");
   };
+
+  // Revokes this browser's refresh token server-side before dropping it
+  // locally, so a copied-out token stops working at logout rather than 30
+  // days later. Deliberately a plain fetch, not apiFetch: with an expired
+  // access token apiFetch would first rotate the refresh token, and this
+  // call would then revoke the old, already-dead one while the fresh one it
+  // just minted stayed live. Fire-and-forget (keepalive), so logging out
+  // never waits on, or fails because of, the network.
+  const doLogout = () => {
+    const rt = getRefreshToken();
+    if (rt) {
+      fetch("/api/auth/logout", {
+        method: "POST",
+        keepalive: true,
+        headers: { ...authHeaders(), "X-Refresh-Token": rt },
+      }).catch(() => {});
+    }
+    clearSession();
+  };
   // The user-initiated "logout" button goes through the same unsaved-work
   // confirmation as any other exit from the Neon editor. The server-driven
   // forced logout below (a dead/expired session even a refresh couldn't
   // fix, see apiFetch's registerUnauthenticatedHandler) deliberately calls
-  // doLogout directly instead -- the session is already gone server-side by
+  // clearSession directly instead -- the session is already gone server-side by
   // that point, so there's nothing a "stay and keep editing" cancel could
   // actually preserve, only a client UI stuck believing it's still logged in.
   const handleLogout = () => guardNeonExit(doLogout);
 
+  // A forced logout has nothing to revoke: apiFetch only calls this once the
+  // refresh token itself was refused, and it has already cleared both tokens.
   useEffect(() => {
-    registerUnauthenticatedHandler(doLogout);
+    registerUnauthenticatedHandler(clearSession);
   }, []);
 
   useEffect(() => {
-    const token = getToken();
-    if (!token) return;
+    // A refresh token alone is still a session: apiFetch's 401 handling
+    // trades it for a new access token on the /api/me call below.
+    if (!getToken() && !getRefreshToken()) return;
     apiFetch("/api/me")
-      .then((r) => (r.ok ? r.json() : Promise.reject()))
-      .then((user) => {
-        setCurrentUser(user);
+      .then(async (r) => {
+        // Usually apiFetch has already logged out and toasted by now, but not
+        // when its refresh succeeded and the retried call still got a 401.
+        if (r.status === 401) return clearSession();
+        if (!r.ok) throw new Error(`/api/me failed (${r.status})`);
+        setCurrentUser(await r.json());
         setView((v) => (v === "landing" ? "projects" : v));
-        return apiFetch("/api/projects");
+        return fetchProjects();
       })
-      .then((r) => r.json())
-      .then((data) => setProjects(normalizeProjects(data)))
-      .catch(() => clearToken());
+      // Anything else -- backend down, a 5xx -- says nothing about whether
+      // the session is valid, so keep the tokens for the next load instead of
+      // logging the user out over a server hiccup.
+      .catch(() =>
+        toast.error("couldn't reach the server — try reloading the page"),
+      );
   }, []);
 
   return (
 
@@ -9,7 +9,7 @@ import type {
   ProjectImage,
   ProjectInitialTab,
 } from "../types";
-import type { CurrentUser } from "../hooks/useAuth";
+import type { AuthSession, CurrentUser } from "../hooks/useAuth";
 import { apiFetch, apiFetchOrThrow, apiFetchJobStream } from "../lib/apiFetch";
 import { minNextStep, pendingIcImages } from "../utils/imageStep";
 import { refreshProject } from "../utils/projects";
@@ -92,7 +92,7 @@ interface AppRouterProps {
   meiContent: { bytes: string; stem: string } | null;
   handleDownloadManifest: () => void;
   handleDownloadMei: () => void;
-  handleLoginSuccess: (user: CurrentUser, token: string) => void;
+  handleLoginSuccess: (session: AuthSession) => void;
   handleLogout: () => void;
   mutations: ReturnType<typeof useProjectMutations>;
   handleEncodeResult: (ev: {
 
@@ -1,11 +1,11 @@
 import LoginForm from "./LoginForm";
 import RegisterForm from "./RegisterForm";
-import type { CurrentUser } from "../../hooks/useAuth";
+import type { AuthSession } from "../../hooks/useAuth";
 
 interface AuthPageProps {
   mode: "login" | "register";
   onSwitchMode: (mode: "login" | "register") => void;
-  onSuccess: (user: CurrentUser, token: string) => void;
+  onSuccess: (session: AuthSession) => void;
 }
 
 export default function AuthPage({
 
@@ -1,9 +1,9 @@
 import { useState } from "react";
-import type { CurrentUser } from "../../hooks/useAuth";
+import type { AuthSession } from "../../hooks/useAuth";
 
 interface LoginFormProps {
   onSwitchToRegister: () => void;
-  onSuccess: (user: CurrentUser, token: string) => void;
+  onSuccess: (session: AuthSession) => void;
 }
 
 export default function LoginForm({
@@ -25,8 +25,8 @@ export default function LoginForm({
       setError("invalid username or password");
       return;
     }
-    const { token, user } = await r.json();
-    onSuccess(user, token);
+    const d = await r.json();
+    onSuccess({ user: d.user, token: d.token, refreshToken: d.refresh_token });
   };
   return (
     <div className="bg-[#C8E6E3] rounded-3xl p-6 sm:p-10 flex flex-col gap-4">
 
@@ -1,9 +1,9 @@
 import { useState } from "react";
-import type { CurrentUser } from "../../hooks/useAuth";
+import type { AuthSession } from "../../hooks/useAuth";
 
 interface RegisterFormProps {
   onSwitchToLogin: () => void;
-  onSuccess: (user: CurrentUser, token: string) => void;
+  onSuccess: (session: AuthSession) => void;
 }
 
 export default function RegisterForm({
@@ -40,8 +40,8 @@ export default function RegisterForm({
       setError((data as { detail?: string }).detail || "registration failed");
       return;
     }
-    const { token, user } = await r.json();
-    onSuccess(user, token);
+    const d = await r.json();
+    onSuccess({ user: d.user, token: d.token, refreshToken: d.refresh_token });
   };
 
   return (
 
@@ -272,11 +272,13 @@ export default function DocsWalkthrough({
           your profile, change your password, or delete your account entirely.
         </p>
         <p className="leading-relaxed">
-          One thing worth knowing: logging in keeps you signed in for 72 hours,
-          and there's currently no way to refresh that without logging in again.
-          If you get signed out mid-workflow, don't worry — your project's
-          progress is saved step by step, so logging back in and reopening the
-          project picks up right where you left off.
+          One thing worth knowing: logging in keeps you signed in on that
+          browser, and mothra quietly renews the session while you keep using it
+          — you'll only be asked to log in again after about a month away.
+          Logging out ends the session on that browser straight away. If you do
+          get signed out mid-workflow, don't worry — your project's progress is
+          saved step by step, so logging back in and reopening the project picks
+          up right where you left off.
         </p>
       </section>
     </div>
 
@@ -6,6 +6,15 @@ export interface CurrentUser {
   createdAt: string;
 }
 
+// What /api/login and /api/register hand back, camel-cased. refreshToken is
+// optional only so a backend predating refresh tokens still logs in -- the
+// access token alone then works until it expires, as it always did.
+export interface AuthSession {
+  user: CurrentUser;
+  token: string;
+  refreshToken?: string;
+}
+
 const TOKEN_KEY = "mothra_token";
 const REFRESH_TOKEN_KEY = "mothra_refresh_token";
 
 
@@ -12,6 +12,25 @@ export function normalizeProjects(raw: Project[]): Project[] {
   }));
 }
 
+/**
+ * GETs the user's whole project list into local state.
+ *
+ * Leaves state untouched on any non-OK response: an error body isn't a
+ * project array, and feeding it to normalizeProjects throws. "unauthenticated"
+ * means a 401 apiFetch couldn't fix by refreshing, so it has already logged
+ * the user out and toasted -- callers only need to report "failed". Network
+ * failures reject, as with any fetch.
+ */
+export async function loadProjects(
+  setProjects: Dispatch<SetStateAction<Project[]>>,
+): Promise<"ok" | "unauthenticated" | "failed"> {
+  const r = await apiFetch("/api/projects");
+  if (r.status === 401) return "unauthenticated";
+  if (!r.ok) return "failed";
+  setProjects(normalizeProjects(await r.json()));
+  return "ok";
+}
+
 /**
  * Re-GETs one project and merges the server's copy into local state.
  *