The typical approach to session refresh is to check whether the token in the sealed cookie is nearing expiration, and if so, call the WorkOS refresh endpoint to obtain a new token, re-seal it, and write it back to the cookie.