# Common questions (https://session-kit.pages.dev/docs/faq)

These are short answers to questions that come up when you adopt Session kit.
Each links to the page with the full answer.

## Do I need a refresh token?

No. Without a refresh token or a `refresh` callback, the user is signed out
when the access token expires or your API rejects it.

## What if my backend doesn't say when the token expires?

The client still works. See [Expiry](https://session-kit.pages.dev/docs/configuration/expiry) for where
the client looks for the expiry, and what it does when it finds none.

## Is it safe to keep tokens in `localStorage`?

Any script on your origin can read them, as [Security](https://session-kit.pages.dev/docs/security)
explains. If that isn't acceptable, keep the session on the server with
[server rendering](https://session-kit.pages.dev/docs/server-rendering).

## How do I use it with TanStack Query, or another cache?

Put [`state.sessionId`](https://session-kit.pages.dev/docs/client/state) in the query key, or clear the
cache when it changes, so one account never reads another's data. With
effetch-query, [`resetKey`](https://session-kit.pages.dev/docs/effect#cache-with-effetch-query) does it.

## Why does TanStack Start in SPA mode flash my pending component?

The build prerenders an HTML shell, which the browser shows before any
JavaScript runs. The client restores the session as soon as the script loads.
Plain TanStack Router shows a blank page for the same moment. Give the shell
a neutral pending component, as
[TanStack Start in SPA mode](https://session-kit.pages.dev/docs/setups/tanstack-router#tanstack-start-in-spa-mode)
does.

## What if some endpoints answer 401 for other reasons?

Set `signOutOnRepeated401: false` in `createAuthFetch`'s options, beside
`baseUrl`, so that a second 401 from those endpoints, after a refresh,
doesn't sign users out. Without a refresh token or a `refresh` callback,
any 401 still signs the user out. See
[Authenticated requests](https://session-kit.pages.dev/docs/client/requests).

## How much does it add to my bundle?

About 11 kB gzipped for a single-page app with a router adapter and
`createAuthFetch`. With server rendering, where the session work happens on
the server, it's about 5 kB. The routers you don't use add nothing: see
[Entry points](https://session-kit.pages.dev/docs/reference).

## Can I sign users in with Google, or a magic link?

Yes, through your backend. Whatever your backend does to sign a user in,
Session kit starts from the tokens it answers with. See
[What it doesn't do](https://session-kit.pages.dev/docs#what-it-doesnt-do).