Worked on the rommapp/romm repository to enhance authentication and API reliability by implementing a robust OAuth token lifecycle using Python and FastAPI. Developed secure refresh token mechanisms, including rotation and invalidation on expiry, with configurable token expiration managed through environment variables. Improved backend stability by introducing graceful handling of authentication failures, preventing server errors when tokens expire. Strengthened configuration robustness with startup validation for token-related settings and aligned tests and constants to maintain consistency. Addressed a TOCTOU race condition to prevent duplicate refresh token use, and improved code hygiene by clarifying token creation paths and enforcing strict token typing.