hm I wonder if okhttp Authenticator can even handle such case, afaik the return value is request to retry, and null to pass 401 downstream

If the user can not get the token from a refresh then they are not authenticated and therefore not allowed to do things that require authentication? No network, no token, no fun.

But, the were not refused a token, jsut network failed, if you then show network error to the ui, user can retry

But if the retry fails is what you were talking about, correct?

yes, but retry requiest fails on network, not 400/500 etc

We’re using grpc and I had to implement auth retry logic. I went with passing IO error downstream.

Yea I think its right thing to do