Best practice for handling access token (JWT) with SSR

[past brook]

We are building a Qwik SSR + SPA app with:

Access token (JWT, short-lived) → stored in client memory
Refresh token → HttpOnly cookie
Client-side works well (401 → refresh → retry).

Problem in SSR (routeLoader$, server$):

Server cannot access client memory (access token)
Only cookies are available

Is there a Qwik-idiomatic way to reuse access token across client → server?
Any recommended pattern using onRequest, sharedMap, or others?

Constraints:

No access token in cookies
No localStorage

[buoyant pine]

You can use sessions with http only session cookies so you use the refresh token to get access token and store in session