Every NPM helper (proxy host create/update/delete, streams, certs) did a
fresh POST /api/tokens login before its actual request, adding an avoidable
round-trip to every proxy/stream operation.
- Cache the JWT per (api_url, email), sized from its 'exp' claim
- Transparently re-authenticate and retry once on a 401 (e.g. after an NPM
restart invalidates a cached token), so a stale cache entry can't cause a
hard failure
Co-Authored-By: Claude Sonnet 5 <[email protected]>