diff --git a/.github/workflows/asa_go_integration.yml b/.github/workflows/asa_go_integration.yml
index c49101ee28..6a0c6445ff 100644
--- a/.github/workflows/asa_go_integration.yml
+++ b/.github/workflows/asa_go_integration.yml
@@ -74,7 +74,7 @@ jobs:
         run: |
           xcodebuild test \
             -scheme "Keycloak" \
-            -destination "platform=iOS Simulator,name=iPhone 16 Pro" \
+            -destination "platform=iOS Simulator,name=iPhone 17" \
             -enableCodeCoverage YES \
             -resultBundlePath ${{ runner.temp }}/keycloak.xcresult
       - name: Upload iOS coverage to Codecov
diff --git a/mobile/asa-go/src/app.test.tsx b/mobile/asa-go/src/app.test.tsx
index 5b88ac32d8..1909de107d 100644
--- a/mobile/asa-go/src/app.test.tsx
+++ b/mobile/asa-go/src/app.test.tsx
@@ -312,7 +312,6 @@ describe('App', () => {
       authentication: {
         sessionMode: 'authenticated',
         authenticating: false,
-        tokenRefreshed: false,
         token: undefined,
         idToken: undefined,
         idir: undefined,
diff --git a/mobile/asa-go/src/components/AuthWrapper.test.tsx b/mobile/asa-go/src/components/AuthWrapper.test.tsx
index 703465d011..b2aaebc8e0 100644
--- a/mobile/asa-go/src/components/AuthWrapper.test.tsx
+++ b/mobile/asa-go/src/components/AuthWrapper.test.tsx
@@ -41,7 +41,6 @@ describe('AuthWrapper', () => {
       sessionMode: 'authenticated',
       authenticating: false,
       error: null,
-      tokenRefreshed: false,
       idToken: undefined,
       idir: undefined,
       token: 'test-token',
@@ -58,7 +57,6 @@ describe('AuthWrapper', () => {
       sessionMode: 'login',
       authenticating: false,
       error: null,
-      tokenRefreshed: false,
       idToken: undefined,
       idir: undefined,
       token: 'test-token',
@@ -79,7 +77,6 @@ describe('AuthWrapper', () => {
         sessionMode: 'login',
         authenticating: false,
         error: null,
-        tokenRefreshed: false,
         idToken: undefined,
         idir: undefined,
         token: undefined,
diff --git a/mobile/asa-go/src/components/LoginActions.test.tsx b/mobile/asa-go/src/components/LoginActions.test.tsx
index 6429949749..1c5803f1f1 100644
--- a/mobile/asa-go/src/components/LoginActions.test.tsx
+++ b/mobile/asa-go/src/components/LoginActions.test.tsx
@@ -26,7 +26,6 @@ const mockAuthState = (authenticating: boolean, error: string | null = null) =>
   vi.spyOn(selectors, 'selectAuthentication').mockReturnValue({
     authenticating,
     error,
-    tokenRefreshed: false,
     idToken: undefined,
     idir: undefined,
     token: undefined,
diff --git a/mobile/asa-go/src/components/PublicLoginButton.test.tsx b/mobile/asa-go/src/components/PublicLoginButton.test.tsx
index a0195f150e..80f9967d48 100644
--- a/mobile/asa-go/src/components/PublicLoginButton.test.tsx
+++ b/mobile/asa-go/src/components/PublicLoginButton.test.tsx
@@ -3,7 +3,7 @@ import { fireEvent, render, screen } from '@testing-library/react'
 import { useDispatch } from 'react-redux'
 import { beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
 import PublicLoginButton from '@/components/PublicLoginButton'
-import { continueAsGuest } from '@/slices/authenticationSlice'
+import { continueAsGuestSession } from '@/slices/authenticationSlice'
 
 vi.mock('react-redux', async () => {
   const actual = await vi.importActual('react-redux')
@@ -14,7 +14,7 @@ vi.mock('react-redux', async () => {
 })
 
 vi.mock('@/slices/authenticationSlice', () => ({
-  continueAsGuest: vi.fn(() => ({ type: 'CONTINUE_AS_GUEST' }))
+  continueAsGuestSession: vi.fn(() => ({ type: 'CONTINUE_AS_GUEST_SESSION' }))
 }))
 
 describe('PublicLoginButton', () => {
@@ -39,11 +39,11 @@ describe('PublicLoginButton', () => {
     expect(screen.getByRole('button', { name: /continue as guest/i })).toBeInTheDocument()
   })
 
-  it('dispatches continueAsGuest on click', () => {
+  it('dispatches continueAsGuestSession on click', () => {
     renderComponent()
 
     fireEvent.click(screen.getByRole('button', { name: /continue as guest/i }))
 
-    expect(mockDispatch).toHaveBeenCalledWith(continueAsGuest())
+    expect(mockDispatch).toHaveBeenCalledWith(continueAsGuestSession())
   })
 })
diff --git a/mobile/asa-go/src/components/PublicLoginButton.tsx b/mobile/asa-go/src/components/PublicLoginButton.tsx
index ca23e8d9d2..d39d16da65 100644
--- a/mobile/asa-go/src/components/PublicLoginButton.tsx
+++ b/mobile/asa-go/src/components/PublicLoginButton.tsx
@@ -1,12 +1,12 @@
 import { Button } from '@mui/material'
 import { useDispatch } from 'react-redux'
-import { continueAsGuest } from '@/slices/authenticationSlice'
+import { continueAsGuestSession } from '@/slices/authenticationSlice'
 import type { AppDispatch } from '@/store'
 
 const PublicLoginButton = () => {
   const dispatch: AppDispatch = useDispatch()
   const handleClick = () => {
-    dispatch(continueAsGuest())
+    dispatch(continueAsGuestSession())
   }
   return (
     <Button onClick={handleClick} sx={{ color: 'white', textDecoration: 'underline' }}>
diff --git a/mobile/asa-go/src/slices/authenticationSlice.test.ts b/mobile/asa-go/src/slices/authenticationSlice.test.ts
index 8cbdedd533..e3890b21c4 100644
--- a/mobile/asa-go/src/slices/authenticationSlice.test.ts
+++ b/mobile/asa-go/src/slices/authenticationSlice.test.ts
@@ -1,28 +1,29 @@
 // @vitest-environment node
 
-import { beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
+import { describe, expect, it, type Mock, vi } from 'vitest'
 import authenticationSlice, {
   type AuthState,
-  authenticate,
   authenticateError,
   authenticateFinished,
   authenticateStart,
   continueAsGuest,
   initialState,
-  refreshTokenFinished,
   resetAuthentication
 } from '@/slices/authenticationSlice'
 import { createTestStore } from '@/testUtils'
-import { Keycloak } from '../../../keycloak/src'
 
 interface TokenResponse {
   accessToken: string
+  idToken?: string
   refreshToken?: string
   tokenType?: string
   expiresIn?: number
   scope?: string
 }
 
+type KeycloakModule = typeof import('../../../keycloak/src')
+type KeycloakPlugin = KeycloakModule['Keycloak']
+
 // Mock valid JWT token with idir_username and email claims
 const mockValidToken =
   'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZGlyX3VzZXJuYW1lIjoiSm9obiBEb2UiLCJlbWFpbCI6ImpvaG4uZG9lQGNvbnRhY3QuY29tIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'
@@ -31,7 +32,8 @@ const mockValidToken =
 vi.mock('../../../keycloak/src', () => ({
   Keycloak: {
     authenticate: vi.fn(),
-    addListener: vi.fn()
+    addListener: vi.fn(),
+    clearAuthState: vi.fn()
   }
 }))
 
@@ -61,6 +63,7 @@ describe('authenticationSlice', () => {
 
   const createTokenResponse = (overrides: Partial<TokenResponse> = {}): TokenResponse => ({
     accessToken: mockValidToken,
+    idToken: 'new-id-token',
     refreshToken: 'new-refresh-token',
     tokenType: 'Bearer',
     expiresIn: 3600,
@@ -69,27 +72,34 @@ describe('authenticationSlice', () => {
   })
 
   // Test helpers for thunk tests
-  const setupStoreWithMockAuth = (mockReturnValue: unknown) => {
+  const setupStoreWithMockAuth = (keycloak: KeycloakPlugin, mockReturnValue: unknown) => {
     const store = createTestStore()
-    ;(Keycloak.authenticate as Mock).mockResolvedValue(mockReturnValue)
+    ;(keycloak.authenticate as Mock).mockResolvedValue(mockReturnValue)
     return store
   }
 
-  const setupTokenRefreshListener = (store: ReturnType<typeof createTestStore>) => {
+  const setupTokenRefreshListener = (keycloak: KeycloakPlugin) => {
     let tokenRefreshCallback: (tokenResponse: TokenResponse) => void = () => {}
 
-    ;(Keycloak.addListener as Mock).mockImplementation((event, callback) => {
+    ;(keycloak.addListener as Mock).mockImplementation((event, callback) => {
       if (event === 'tokenRefresh') {
         tokenRefreshCallback = callback
       }
     })
 
     return {
-      store,
       tokenRefreshCallback: (response: TokenResponse) => tokenRefreshCallback(response)
     }
   }
 
+  const loadFreshAuthModules = async () => {
+    vi.resetAllMocks()
+    vi.resetModules()
+    const auth = await import('@/slices/authenticationSlice')
+    const { Keycloak } = await import('../../../keycloak/src')
+    return { auth, Keycloak }
+  }
+
   const expectAuthState = (state: AuthState, expected: Partial<AuthState>) => {
     Object.entries(expected).forEach(([key, value]) => {
       expect(state[key as keyof AuthState]).toBe(value)
@@ -122,7 +132,8 @@ describe('authenticationSlice', () => {
         sessionMode: 'authenticated',
         token: 'existing-token',
         idToken: 'existing-id-token',
-        idir: 'test-user'
+        idir: 'test-user',
+        email: 'test@example.com'
       })
 
       const nextState = authenticationSlice(previousState, continueAsGuest())
@@ -133,6 +144,7 @@ describe('authenticationSlice', () => {
         token: undefined,
         idToken: undefined,
         idir: undefined,
+        email: undefined,
         error: null
       })
     })
@@ -157,7 +169,11 @@ describe('authenticationSlice', () => {
     it('should handle authenticateError', () => {
       const previousState = createAuthState({
         authenticating: true,
-        sessionMode: 'authenticated'
+        sessionMode: 'authenticated',
+        token: 'existing-token',
+        idToken: 'existing-id-token',
+        idir: 'test-user',
+        email: 'test@example.com'
       })
       const errorMessage = 'Authentication failed'
 
@@ -166,80 +182,46 @@ describe('authenticationSlice', () => {
       expectAuthState(nextState, {
         sessionMode: 'login',
         authenticating: false,
-        error: errorMessage
-      })
-    })
-
-    it('should handle refreshTokenFinished', () => {
-      const previousState = createAuthState({
-        token: 'old-token',
-        idToken: 'old-id-token',
-        tokenRefreshed: false
-      })
-      const payload = {
-        tokenRefreshed: true,
-        token: mockValidToken,
-        idToken: 'new-id-token'
-      }
-
-      const nextState = authenticationSlice(previousState, refreshTokenFinished(payload))
-
-      expectAuthState(nextState, {
-        sessionMode: 'authenticated',
-        token: mockValidToken,
-        idToken: 'new-id-token',
-        tokenRefreshed: true
-      })
-    })
-
-    it('should handle refreshTokenFinished with undefined tokens', () => {
-      const previousState = createAuthState({
-        token: 'existing-token',
-        idToken: 'existing-id-token',
-        tokenRefreshed: false
-      })
-      const payload = {
-        tokenRefreshed: false,
+        error: errorMessage,
         token: undefined,
-        idToken: undefined
-      }
-
-      const nextState = authenticationSlice(previousState, refreshTokenFinished(payload))
-
-      expect(nextState.token).toBeUndefined()
-      expect(nextState.idToken).toBeUndefined()
-      expect(nextState.tokenRefreshed).toBe(false)
+        idToken: undefined,
+        idir: undefined,
+        email: undefined
+      })
     })
 
     it('should handle resetAuthentication', () => {
       const previousState = createAuthState({
         sessionMode: 'authenticated',
+        authenticating: true,
         token: 'existing-token',
         idToken: 'existing-id-token',
-        idir: 'test-user'
+        idir: 'test-user',
+        email: 'test@example.com',
+        error: 'existing-error'
       })
 
       const nextState = authenticationSlice(previousState, resetAuthentication())
 
       expectAuthState(nextState, {
         sessionMode: 'login',
+        authenticating: false,
         token: undefined,
         idToken: undefined,
-        idir: undefined
+        idir: undefined,
+        email: undefined,
+        error: null
       })
     })
   })
 
   describe('thunks', () => {
-    beforeEach(() => {
-      vi.resetAllMocks()
-    })
-
     describe('authenticate', () => {
       it('should dispatch authenticateStart when called', async () => {
-        const store = setupStoreWithMockAuth(createSuccessfulAuthResult())
+        const { auth, Keycloak } = await loadFreshAuthModules()
+        const store = setupStoreWithMockAuth(Keycloak, createSuccessfulAuthResult())
 
-        await store.dispatch(authenticate())
+        await store.dispatch(auth.authenticate())
 
         expectAuthState(store.getState().authentication, {
           authenticating: false // Should be false after completion
@@ -247,12 +229,13 @@ describe('authenticationSlice', () => {
       })
 
       it('should dispatch authenticateFinished on successful authentication', async () => {
+        const { auth, Keycloak } = await loadFreshAuthModules()
         const mockResult = createSuccessfulAuthResult({
           accessToken: mockValidToken
         })
-        const store = setupStoreWithMockAuth(mockResult)
+        const store = setupStoreWithMockAuth(Keycloak, mockResult)
 
-        await store.dispatch(authenticate())
+        await store.dispatch(auth.authenticate())
 
         expectAuthState(store.getState().authentication, {
           sessionMode: 'authenticated',
@@ -265,10 +248,11 @@ describe('authenticationSlice', () => {
       })
 
       it('should dispatch authenticateError on failed authentication with error message', async () => {
+        const { auth, Keycloak } = await loadFreshAuthModules()
         const mockResult = createFailedAuthResult('Invalid credentials')
-        const store = setupStoreWithMockAuth(mockResult)
+        const store = setupStoreWithMockAuth(Keycloak, mockResult)
 
-        await store.dispatch(authenticate())
+        await store.dispatch(auth.authenticate())
 
         expectAuthState(store.getState().authentication, {
           sessionMode: 'login',
@@ -278,10 +262,11 @@ describe('authenticationSlice', () => {
       })
 
       it('should dispatch authenticateError on failed authentication without error message', async () => {
+        const { auth, Keycloak } = await loadFreshAuthModules()
         const mockResult = createFailedAuthResult()
-        const store = setupStoreWithMockAuth(mockResult)
+        const store = setupStoreWithMockAuth(Keycloak, mockResult)
 
-        await store.dispatch(authenticate())
+        await store.dispatch(auth.authenticate())
 
         expectAuthState(store.getState().authentication, {
           sessionMode: 'login',
@@ -293,9 +278,10 @@ describe('authenticationSlice', () => {
       // Note: Testing promise rejection scenarios is complex due to async thunk behavior
       // The important flows (success and handled errors) are covered above
       it('should call Keycloak.authenticate when authentication is initiated', async () => {
-        const store = setupStoreWithMockAuth(createSuccessfulAuthResult())
+        const { auth, Keycloak } = await loadFreshAuthModules()
+        const store = setupStoreWithMockAuth(Keycloak, createSuccessfulAuthResult())
 
-        await store.dispatch(authenticate())
+        await store.dispatch(auth.authenticate())
 
         // Verify Keycloak.authenticate was called with the expected mocked values
         expect(Keycloak.authenticate).toHaveBeenCalledWith({
@@ -307,36 +293,48 @@ describe('authenticationSlice', () => {
       })
 
       it('should set up token refresh listener', async () => {
-        const store = setupStoreWithMockAuth(createSuccessfulAuthResult())
+        const { auth, Keycloak } = await loadFreshAuthModules()
+        const store = setupStoreWithMockAuth(Keycloak, createSuccessfulAuthResult())
 
-        await store.dispatch(authenticate())
+        await store.dispatch(auth.authenticate())
 
         expect(Keycloak.addListener).toHaveBeenCalledWith('tokenRefresh', expect.any(Function))
       })
 
+      it('registers the token refresh listener once across repeated authentication attempts', async () => {
+        const { auth, Keycloak } = await loadFreshAuthModules()
+        const store = setupStoreWithMockAuth(Keycloak, createSuccessfulAuthResult())
+
+        await store.dispatch(auth.authenticate())
+        await store.dispatch(auth.authenticate())
+
+        expect(Keycloak.addListener).toHaveBeenCalledTimes(1)
+      })
+
       it('should handle token refresh callback correctly', async () => {
-        const store = setupStoreWithMockAuth(createSuccessfulAuthResult())
-        const { tokenRefreshCallback } = setupTokenRefreshListener(store)
+        const { auth, Keycloak } = await loadFreshAuthModules()
+        const store = setupStoreWithMockAuth(Keycloak, createSuccessfulAuthResult())
+        const { tokenRefreshCallback } = setupTokenRefreshListener(Keycloak)
 
-        await store.dispatch(authenticate())
+        await store.dispatch(auth.authenticate())
 
         // Simulate token refresh
         const tokenResponse = createTokenResponse()
         tokenRefreshCallback(tokenResponse)
 
         expectAuthState(store.getState().authentication, {
-          tokenRefreshed: true,
-          token: mockValidToken
+          token: mockValidToken,
+          idToken: 'new-id-token'
         })
-        expect(store.getState().authentication.idToken).toBeUndefined()
         expect(mockSetUser).toHaveBeenCalledWith({ email: 'john.doe@contact.com' })
       })
 
       it('should not update state when token refresh has no refresh token', async () => {
-        const store = setupStoreWithMockAuth(createSuccessfulAuthResult())
-        const { tokenRefreshCallback } = setupTokenRefreshListener(store)
+        const { auth, Keycloak } = await loadFreshAuthModules()
+        const store = setupStoreWithMockAuth(Keycloak, createSuccessfulAuthResult())
+        const { tokenRefreshCallback } = setupTokenRefreshListener(Keycloak)
 
-        await store.dispatch(authenticate())
+        await store.dispatch(auth.authenticate())
 
         const initialState = store.getState().authentication
 
@@ -345,9 +343,49 @@ describe('authenticationSlice', () => {
         tokenRefreshCallback(tokenResponse)
 
         const finalState = store.getState().authentication
-        expect(finalState.tokenRefreshed).toBe(initialState.tokenRefreshed)
         expect(finalState.token).toBe(initialState.token)
       })
+
+      it('clears native auth state before continuing as guest', async () => {
+        const { auth, Keycloak } = await loadFreshAuthModules()
+        ;(Keycloak.clearAuthState as Mock).mockResolvedValue(undefined)
+        const store = createTestStore({
+          authentication: createAuthState({
+            sessionMode: 'authenticated',
+            token: mockValidToken,
+            idToken: 'existing-id-token',
+            idir: 'test-user',
+            email: 'test@example.com'
+          })
+        })
+
+        await store.dispatch(auth.continueAsGuestSession())
+
+        expect(Keycloak.clearAuthState).toHaveBeenCalled()
+        expectAuthState(store.getState().authentication, {
+          sessionMode: 'guest',
+          token: undefined,
+          idToken: undefined,
+          idir: undefined,
+          email: undefined
+        })
+        expect(mockSetUser).toHaveBeenCalledWith(null)
+      })
+
+      it('continues as guest when native auth clear fails', async () => {
+        const { auth, Keycloak } = await loadFreshAuthModules()
+        ;(Keycloak.clearAuthState as Mock).mockRejectedValue(new Error('clear failed'))
+        const store = createTestStore({
+          authentication: createAuthState({
+            sessionMode: 'authenticated',
+            token: mockValidToken
+          })
+        })
+
+        await store.dispatch(auth.continueAsGuestSession())
+
+        expect(store.getState().authentication.sessionMode).toBe('guest')
+      })
     })
   })
 })
diff --git a/mobile/asa-go/src/slices/authenticationSlice.ts b/mobile/asa-go/src/slices/authenticationSlice.ts
index fcf7b3eb29..26945937d0 100644
--- a/mobile/asa-go/src/slices/authenticationSlice.ts
+++ b/mobile/asa-go/src/slices/authenticationSlice.ts
@@ -2,15 +2,15 @@ import { createSlice, type PayloadAction } from '@reduxjs/toolkit'
 import * as Sentry from '@sentry/capacitor'
 import { jwtDecode } from 'jwt-decode'
 import { isUndefined } from 'lodash'
-import type { AppThunk } from '@/store'
+import type { AppDispatch, AppThunk } from '@/store'
 import { Keycloak } from '../../../keycloak/src'
+import type { KeycloakTokenResponse } from '../../../keycloak/src/definitions'
 
 export type AuthSessionMode = 'login' | 'guest' | 'authenticated'
 
 export interface AuthState {
   sessionMode: AuthSessionMode
   authenticating: boolean
-  tokenRefreshed: boolean
   token: string | undefined
   idToken: string | undefined
   idir: string | undefined
@@ -21,7 +21,6 @@ export interface AuthState {
 export const initialState: AuthState = {
   sessionMode: 'login',
   authenticating: false,
-  tokenRefreshed: false,
   token: undefined,
   idToken: undefined,
   idir: undefined,
@@ -39,6 +38,7 @@ const authSlice = createSlice({
       state.token = undefined
       state.idToken = undefined
       state.idir = undefined
+      state.email = undefined
       state.error = null
     },
     authenticateStart(state: AuthState) {
@@ -61,51 +61,55 @@ const authSlice = createSlice({
       state.token = action.payload.token
       state.idToken = action.payload.idToken
     },
-    authenticateError(state: AuthState, action: PayloadAction<string>) {
-      state.authenticating = false
-      state.sessionMode = 'login'
-      state.error = action.payload
-    },
-    refreshTokenFinished(
-      state: AuthState,
-      action: PayloadAction<{
-        tokenRefreshed: boolean
-        token: string | undefined
-        idToken: string | undefined
-      }>
-    ) {
-      const userDetails = decodeUserDetails(action.payload.token)
-      state.idir = userDetails?.idir
-      state.email = userDetails?.email
-      state.token = action.payload.token
-      state.idToken = action.payload.idToken
-      state.tokenRefreshed = action.payload.tokenRefreshed
-      if (!isUndefined(action.payload.token)) {
-        state.sessionMode = 'authenticated'
+    authenticateError(_state: AuthState, action: PayloadAction<string>) {
+      return {
+        ...initialState,
+        error: action.payload
       }
     },
-    resetAuthentication(state: AuthState) {
-      state.sessionMode = 'login'
-      state.idToken = undefined
-      state.token = undefined
-      state.idir = undefined
+    resetAuthentication() {
+      return { ...initialState }
     }
   }
 })
 
-export const {
-  continueAsGuest,
-  authenticateStart,
-  authenticateFinished,
-  authenticateError,
-  refreshTokenFinished,
-  resetAuthentication
-} = authSlice.actions
+export const { continueAsGuest, authenticateStart, authenticateFinished, authenticateError, resetAuthentication } =
+  authSlice.actions
 
 export default authSlice.reducer
 
+let tokenRefreshListenerActive = false
+
+export const continueAsGuestSession = () => async (dispatch: AppDispatch) => {
+  try {
+    await Keycloak.clearAuthState()
+  } catch {
+    // keep guest mode available even if native auth storage cleanup fails
+  }
+  dispatch(continueAsGuest())
+  setSentryUserFromToken(undefined)
+}
+
+const registerTokenRefreshListener = (dispatch: AppDispatch) => {
+  if (!tokenRefreshListenerActive) {
+    tokenRefreshListenerActive = true
+    Keycloak.addListener('tokenRefresh', (tokenResponse: KeycloakTokenResponse) => {
+      if (tokenResponse.refreshToken) {
+        dispatch(
+          authenticateFinished({
+            token: tokenResponse.accessToken,
+            idToken: tokenResponse.idToken
+          })
+        )
+        setSentryUserFromToken(tokenResponse.accessToken)
+      }
+    })
+  }
+}
+
 export const authenticate = (): AppThunk => dispatch => {
   dispatch(authenticateStart())
+  registerTokenRefreshListener(dispatch)
 
   const realm = import.meta.env.VITE_KEYCLOAK_REALM
   const authUrl = `${import.meta.env.VITE_KEYCLOAK_AUTH_URL}/realms/${realm}/protocol/openid-connect/auth`
@@ -126,8 +130,7 @@ export const authenticate = (): AppThunk => dispatch => {
             idToken: result.idToken
           })
         )
-        const userDetails = decodeUserDetails(result.accessToken)
-        Sentry.setUser(userDetails ? { email: userDetails.email } : null)
+        setSentryUserFromToken(result.accessToken)
       } else {
         dispatch(authenticateError(JSON.stringify(result.error)))
       }
@@ -135,31 +138,6 @@ export const authenticate = (): AppThunk => dispatch => {
     .catch(error => {
       dispatch(authenticateError(JSON.stringify(error)))
     })
-
-  // Handle token refresh callback function
-  const handleTokenRefresh = (tokenResponse: {
-    accessToken: string
-    idToken: string
-    refreshToken?: string
-    tokenType?: string
-    expiresIn?: number
-    scope?: string
-  }) => {
-    if (tokenResponse.refreshToken) {
-      dispatch(
-        refreshTokenFinished({
-          tokenRefreshed: true,
-          token: tokenResponse.accessToken,
-          idToken: tokenResponse.idToken
-        })
-      )
-      const userDetails = decodeUserDetails(tokenResponse.accessToken)
-      Sentry.setUser(userDetails ? { email: userDetails.email } : null)
-    }
-  }
-
-  // Set up event listener for token refresh events (works for both web and iOS)
-  Keycloak.addListener('tokenRefresh', handleTokenRefresh)
 }
 
 export const decodeUserDetails = (token: string | undefined) => {
@@ -175,3 +153,8 @@ export const decodeUserDetails = (token: string | undefined) => {
     return undefined
   }
 }
+
+export const setSentryUserFromToken = (token: string | undefined) => {
+  const userDetails = decodeUserDetails(token)
+  Sentry.setUser(userDetails ? { email: userDetails.email } : null)
+}
diff --git a/mobile/asa-go/src/slices/pushNotificationSlice.test.ts b/mobile/asa-go/src/slices/pushNotificationSlice.test.ts
index 52a6e110bb..07388704b9 100644
--- a/mobile/asa-go/src/slices/pushNotificationSlice.test.ts
+++ b/mobile/asa-go/src/slices/pushNotificationSlice.test.ts
@@ -141,7 +141,6 @@ describe('pushNotificationSlice', () => {
             error: null,
             idir: 'test-user',
             authenticating: false,
-            tokenRefreshed: false,
             token: undefined,
             idToken: undefined,
             email: undefined
@@ -212,7 +211,6 @@ describe('pushNotificationSlice', () => {
             error: null,
             idir: 'test-user',
             authenticating: false,
-            tokenRefreshed: false,
             token: undefined,
             idToken: undefined,
             email: undefined
diff --git a/mobile/asa-go/src/utils/axiosInterceptor.test.ts b/mobile/asa-go/src/utils/axiosInterceptor.test.ts
index 79d3934434..de7155e5f9 100644
--- a/mobile/asa-go/src/utils/axiosInterceptor.test.ts
+++ b/mobile/asa-go/src/utils/axiosInterceptor.test.ts
@@ -16,11 +16,15 @@ const setup = async ({
 } = {}) => {
   vi.resetModules()
 
+  const axiosRequest = vi.fn().mockResolvedValue({ data: 'retried-response' })
   const requestUse = vi.fn()
   const responseUse = vi.fn()
   const resetAuthenticationAction = {
     type: 'authentication/resetAuthentication'
   }
+  const authenticateFinishedAction = {
+    type: 'authentication/authenticateFinished'
+  }
   const store = {
     getState: vi.fn(() => ({ authentication: { sessionMode, token } })),
     dispatch: vi.fn()
@@ -36,34 +40,56 @@ const setup = async ({
     }
   )
   const resetAuthentication = vi.fn(() => resetAuthenticationAction)
+  const authenticateFinished = vi.fn(() => authenticateFinishedAction)
+  const setSentryUserFromToken = vi.fn()
+  const refreshAuthState = vi.fn().mockResolvedValue({
+    isAuthenticated: true,
+    accessToken: 'new-token',
+    idToken: 'new-id-token'
+  })
+  const clearAuthState = vi.fn().mockResolvedValue(undefined)
 
   vi.doMock('@/api/axios', () => ({
-    default: {
+    default: Object.assign(axiosRequest, {
       interceptors: {
         request: { use: requestUse },
         response: { use: responseUse }
       }
-    }
+    })
   }))
   vi.doMock('@/store', () => ({
     store,
     selectAuthentication
   }))
   vi.doMock('@/slices/authenticationSlice', () => ({
-    resetAuthentication
+    authenticateFinished,
+    resetAuthentication,
+    setSentryUserFromToken
   }))
   vi.doMock('@/utils/env', () => ({
     API_BASE_URL,
     API_PUBLIC_BASE_URL
   }))
+  vi.doMock('../../../keycloak/src', () => ({
+    Keycloak: {
+      refreshAuthState,
+      clearAuthState
+    }
+  }))
 
   const { configureApiInterceptors } = await import('@/utils/axiosInterceptor')
 
   return {
     configureApiInterceptors,
+    authenticateFinished,
+    authenticateFinishedAction,
+    axiosRequest,
     requestUse,
     resetAuthentication,
     responseUse,
+    setSentryUserFromToken,
+    refreshAuthState,
+    clearAuthState,
     resetAuthenticationAction,
     store
   }
@@ -86,9 +112,19 @@ const runRequestInterceptor = (
   } as InternalAxiosRequestConfig)
 }
 
-const runErrorInterceptor = (responseUse: ReturnType<typeof vi.fn>, status: number) => {
+const runErrorInterceptor = (
+  responseUse: ReturnType<typeof vi.fn>,
+  status: number,
+  config: Partial<InternalAxiosRequestConfig> = {}
+) => {
   const errorInterceptor = responseUse.mock.calls[0][1]
-  const error = { response: { status } }
+  const error = {
+    config: {
+      headers: new AxiosHeaders(),
+      ...config
+    },
+    response: { status }
+  }
   return { error, promise: errorInterceptor(error) }
 }
 
@@ -139,21 +175,82 @@ describe('configureApiInterceptors', () => {
     expect(result.headers.get('Authorization')).toBeUndefined()
   })
 
-  it('resets authentication on 401 responses', async () => {
-    const { responseUse, resetAuthenticationAction, store } = await configure()
+  it('refreshes authentication and retries on 401 responses', async () => {
+    const {
+      authenticateFinishedAction,
+      axiosRequest,
+      clearAuthState,
+      refreshAuthState,
+      responseUse,
+      setSentryUserFromToken,
+      store
+    } = await configure()
     const { error, promise } = runErrorInterceptor(responseUse, 401)
 
+    await expect(promise).resolves.toEqual({ data: 'retried-response' })
+
+    expect(refreshAuthState).toHaveBeenCalled()
+    expect(clearAuthState).not.toHaveBeenCalled()
+    expect(store.dispatch).toHaveBeenCalledWith(authenticateFinishedAction)
+    expect(setSentryUserFromToken).toHaveBeenCalledWith('new-token')
+    expect(error.config.headers.get('Authorization')).toBe('Bearer new-token')
+    expect(axiosRequest).toHaveBeenCalledWith(error.config)
+  })
+
+  it('does not refresh native auth for guest 401 responses', async () => {
+    const { clearAuthState, refreshAuthState, responseUse, store } = await configure({
+      sessionMode: 'guest',
+      token: null
+    })
+    const { error, promise } = runErrorInterceptor(responseUse, 401)
+
+    await expect(promise).rejects.toBe(error)
+
+    expect(refreshAuthState).not.toHaveBeenCalled()
+    expect(clearAuthState).not.toHaveBeenCalled()
+    expect(store.dispatch).not.toHaveBeenCalled()
+  })
+
+  it('resets authentication when refresh fails on 401 responses', async () => {
+    const { clearAuthState, refreshAuthState, responseUse, resetAuthenticationAction, setSentryUserFromToken, store } =
+      await configure()
+    refreshAuthState.mockResolvedValue({
+      isAuthenticated: false,
+      error: 'refresh_failed'
+    })
+    const { error, promise } = runErrorInterceptor(responseUse, 401)
+
+    await expect(promise).rejects.toBe(error)
+
+    expect(refreshAuthState).toHaveBeenCalled()
+    expect(clearAuthState).toHaveBeenCalled()
+    expect(store.dispatch).toHaveBeenCalledWith(resetAuthenticationAction)
+    expect(setSentryUserFromToken).toHaveBeenCalledWith(undefined)
+  })
+
+  it('does not retry repeated 401 responses', async () => {
+    const { clearAuthState, refreshAuthState, responseUse, resetAuthenticationAction, setSentryUserFromToken, store } =
+      await configure()
+    const { error, promise } = runErrorInterceptor(responseUse, 401, {
+      _retryAfterAuthRefresh: true
+    } as Partial<InternalAxiosRequestConfig>)
+
     await expect(promise).rejects.toBe(error)
 
+    expect(refreshAuthState).not.toHaveBeenCalled()
+    expect(clearAuthState).toHaveBeenCalled()
     expect(store.dispatch).toHaveBeenCalledWith(resetAuthenticationAction)
+    expect(setSentryUserFromToken).toHaveBeenCalledWith(undefined)
   })
 
   it('does not reset authentication for non-401 responses', async () => {
-    const { responseUse, store } = await configure()
+    const { clearAuthState, refreshAuthState, responseUse, store } = await configure()
     const { error, promise } = runErrorInterceptor(responseUse, 500)
 
     await expect(promise).rejects.toBe(error)
 
+    expect(refreshAuthState).not.toHaveBeenCalled()
+    expect(clearAuthState).not.toHaveBeenCalled()
     expect(store.dispatch).not.toHaveBeenCalled()
   })
 })
diff --git a/mobile/asa-go/src/utils/axiosInterceptor.ts b/mobile/asa-go/src/utils/axiosInterceptor.ts
index a40c292825..30c07a1efc 100644
--- a/mobile/asa-go/src/utils/axiosInterceptor.ts
+++ b/mobile/asa-go/src/utils/axiosInterceptor.ts
@@ -1,12 +1,62 @@
-import * as Sentry from '@sentry/capacitor'
-import { isNil } from 'lodash'
+import type { InternalAxiosRequestConfig } from 'axios'
 import axios from '@/api/axios'
-import { resetAuthentication } from '@/slices/authenticationSlice'
+import { authenticateFinished, resetAuthentication, setSentryUserFromToken } from '@/slices/authenticationSlice'
 import { selectAuthentication, store } from '@/store'
 import { API_BASE_URL, API_PUBLIC_BASE_URL } from '@/utils/env'
+import { Keycloak } from '../../../keycloak/src'
 
 let interceptorsConfigured = false
 
+interface RetriableAxiosRequestConfig extends InternalAxiosRequestConfig {
+  _retryAfterAuthRefresh?: boolean
+}
+
+const configureRequestBaseUrl = (config: InternalAxiosRequestConfig) => {
+  const { sessionMode, token } = selectAuthentication(store.getState())
+  if (sessionMode === 'authenticated' && token != null) {
+    config.baseURL = API_BASE_URL
+    config.headers.set('Authorization', `Bearer ${token}`)
+    return config
+  }
+
+  config.baseURL = `${API_PUBLIC_BASE_URL}/asa-go`
+  config.headers.delete('Authorization')
+  return config
+}
+
+const retryWithRefreshedToken = async (request: RetriableAxiosRequestConfig | undefined) => {
+  if (!request || request._retryAfterAuthRefresh === true) {
+    return
+  }
+
+  request._retryAfterAuthRefresh = true
+  const refreshResult = await Keycloak.refreshAuthState()
+  if (!refreshResult.isAuthenticated || !refreshResult.accessToken) {
+    return
+  }
+
+  store.dispatch(
+    authenticateFinished({
+      token: refreshResult.accessToken,
+      idToken: refreshResult.idToken
+    })
+  )
+  setSentryUserFromToken(refreshResult.accessToken)
+  request.baseURL = API_BASE_URL
+  request.headers.set('Authorization', `Bearer ${refreshResult.accessToken}`)
+  return axios(request)
+}
+
+const resetStoredAuthentication = async () => {
+  try {
+    await Keycloak.clearAuthState()
+  } catch {
+    // keep resetting app auth even if native storage cleanup fails
+  }
+  store.dispatch(resetAuthentication())
+  setSentryUserFromToken(undefined)
+}
+
 export const configureApiInterceptors = () => {
   if (interceptorsConfigured) {
     return
@@ -14,30 +64,30 @@ export const configureApiInterceptors = () => {
 
   interceptorsConfigured = true
 
-  axios.interceptors.request.use(config => {
-    const { sessionMode, token } = selectAuthentication(store.getState())
-    if (sessionMode === 'authenticated' && !isNil(token)) {
-      config.baseURL = API_BASE_URL
-      config.headers.set('Authorization', `Bearer ${token}`)
-    } else {
-      config.baseURL = `${API_PUBLIC_BASE_URL}/asa-go`
-      config.headers.delete('Authorization')
-    }
-
-    return config
-  })
+  axios.interceptors.request.use(configureRequestBaseUrl)
 
   axios.interceptors.response.use(
     // If there is a response we simply return it
     response => response,
 
-    // If there is a 401 error we force re-authentication; otherwise we forward the error.
-    error => {
-      if (error?.response?.status === 401) {
-        store.dispatch(resetAuthentication())
-        Sentry.setUser(null)
+    // If there is a 401 error we try the offline token before forcing re-authentication.
+    async error => {
+      if (error?.response?.status !== 401) {
+        throw error
+      }
+
+      const { sessionMode } = selectAuthentication(store.getState())
+      if (sessionMode !== 'authenticated') {
+        throw error
       }
-      return Promise.reject(error)
+
+      const retryResponse = await retryWithRefreshedToken(error?.config as RetriableAxiosRequestConfig | undefined)
+      if (retryResponse) {
+        return retryResponse
+      }
+
+      await resetStoredAuthentication()
+      throw error
     }
   )
 }
diff --git a/mobile/keycloak/README.md b/mobile/keycloak/README.md
index b6a26a98a3..37e88af312 100644
--- a/mobile/keycloak/README.md
+++ b/mobile/keycloak/README.md
@@ -14,6 +14,8 @@ npx cap sync
 <docgen-index>
 
 * [`authenticate(...)`](#authenticate)
+* [`refreshAuthState()`](#refreshauthstate)
+* [`clearAuthState()`](#clearauthstate)
 * [`addListener(string, ...)`](#addlistenerstring-)
 * [Interfaces](#interfaces)
 
@@ -39,6 +41,30 @@ Authenticate against a Keycloak provider.
 --------------------
 
 
+### refreshAuthState()
+
+```typescript
+refreshAuthState() => Promise<KeycloakAuthResponse>
+```
+
+Refresh the stored native authentication state without launching browser auth.
+
+**Returns:** <code>Promise&lt;<a href="#keycloakauthresponse">KeycloakAuthResponse</a>&gt;</code>
+
+--------------------
+
+
+### clearAuthState()
+
+```typescript
+clearAuthState() => Promise<void>
+```
+
+Clear any stored native authentication state.
+
+--------------------
+
+
 ### addListener(string, ...)
 
 ```typescript
diff --git a/mobile/keycloak/android/build.gradle b/mobile/keycloak/android/build.gradle
index 691d51f52c..5a5b7fca69 100644
--- a/mobile/keycloak/android/build.gradle
+++ b/mobile/keycloak/android/build.gradle
@@ -72,6 +72,8 @@ dependencies {
     implementation project(':capacitor-android')
     implementation "androidx.appcompat:appcompat:$androidxAppCompatVersion"
     implementation 'androidx.browser:browser:1.10.0'
+    implementation 'androidx.datastore:datastore-preferences-rxjava3:1.2.1'
+    implementation 'com.google.crypto.tink:tink-android:1.18.0'
     implementation 'com.squareup.okhttp3:okhttp:5.4.0'
     implementation 'net.openid:appauth:0.11.1'
     testImplementation "junit:junit:$junitVersion"
diff --git a/mobile/keycloak/android/src/main/java/ca/bcgov/plugins/keycloak/AuthStateStore.java b/mobile/keycloak/android/src/main/java/ca/bcgov/plugins/keycloak/AuthStateStore.java
new file mode 100644
index 0000000000..d2913b9981
--- /dev/null
+++ b/mobile/keycloak/android/src/main/java/ca/bcgov/plugins/keycloak/AuthStateStore.java
@@ -0,0 +1,149 @@
+package ca.bcgov.plugins.keycloak;
+
+import android.content.Context;
+import android.content.SharedPreferences;
+import android.util.Base64;
+import android.util.Log;
+import androidx.annotation.Nullable;
+import androidx.datastore.preferences.core.MutablePreferences;
+import androidx.datastore.preferences.core.Preferences;
+import androidx.datastore.preferences.core.PreferencesKeys;
+import androidx.datastore.preferences.rxjava3.RxPreferenceDataStoreBuilder;
+import androidx.datastore.rxjava3.RxDataStore;
+import com.google.crypto.tink.Aead;
+import com.google.crypto.tink.KeyTemplates;
+import com.google.crypto.tink.RegistryConfiguration;
+import com.google.crypto.tink.aead.AeadConfig;
+import com.google.crypto.tink.integration.android.AndroidKeysetManager;
+import io.reactivex.rxjava3.core.Single;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.security.GeneralSecurityException;
+
+class AuthStateStore {
+
+    private static final String TAG = "Keycloak";
+    private static final String DATASTORE_NAME = "keycloak_auth_state";
+    private static final String KEY_AUTH_STATE = "auth_state";
+    private static final String LEGACY_PREFS_NAME = "KeycloakAuthState";
+    private static final String TINK_KEYSET_NAME = "keycloak_auth_state_keyset";
+    private static final String TINK_KEYSET_PREFS_NAME = "keycloak_auth_state_keyset_prefs";
+    private static final String MASTER_KEY_URI = "android-keystore://keycloak_auth_state_master_key";
+    private static final Preferences.Key<String> AUTH_STATE_KEY = PreferencesKeys.stringKey(KEY_AUTH_STATE);
+    private static final Object DATASTORE_LOCK = new Object();
+
+    private static RxDataStore<Preferences> dataStore;
+
+    private final Context context;
+    private final Aead aead;
+
+    AuthStateStore(Context context) throws GeneralSecurityException, IOException {
+        this.context = context.getApplicationContext();
+        AeadConfig.register();
+        this.aead = new AndroidKeysetManager.Builder()
+            .withSharedPref(this.context, TINK_KEYSET_NAME, TINK_KEYSET_PREFS_NAME)
+            .withKeyTemplate(KeyTemplates.get("AES256_GCM"))
+            .withMasterKeyUri(MASTER_KEY_URI)
+            .build()
+            .getKeysetHandle()
+            .getPrimitive(RegistryConfiguration.get(), Aead.class);
+        getDataStore(this.context);
+    }
+
+    @Nullable
+    String read() {
+        try {
+            Preferences preferences = getDataStore(context).data().firstOrError().blockingGet();
+            String encryptedState = preferences.get(AUTH_STATE_KEY);
+
+            if (encryptedState != null) {
+                try {
+                    return decrypt(encryptedState);
+                } catch (GeneralSecurityException | IllegalArgumentException e) {
+                    Log.e(TAG, "Failed to decrypt stored auth state", e);
+                    clear();
+                    return null;
+                }
+            }
+
+            String legacyState = readLegacyAuthState();
+            if (legacyState != null && write(legacyState)) {
+                clearLegacyAuthState();
+                Log.d(TAG, "Migrated auth state to encrypted DataStore");
+            }
+            return legacyState;
+        } catch (Exception e) {
+            Log.e(TAG, "Failed to read auth state from encrypted DataStore", e);
+            return null;
+        }
+    }
+
+    boolean write(String stateJson) {
+        try {
+            String encryptedState = encrypt(stateJson);
+            getDataStore(context)
+                .updateDataAsync(preferences -> {
+                    MutablePreferences mutablePreferences = preferences.toMutablePreferences();
+                    mutablePreferences.set(AUTH_STATE_KEY, encryptedState);
+                    return Single.just(mutablePreferences);
+                })
+                .blockingGet();
+            Log.d(TAG, "Auth state persisted to encrypted DataStore");
+            return true;
+        } catch (Exception e) {
+            Log.e(TAG, "Failed to persist auth state to encrypted DataStore", e);
+            return false;
+        }
+    }
+
+    void clear() {
+        try {
+            getDataStore(context)
+                .updateDataAsync(preferences -> {
+                    MutablePreferences mutablePreferences = preferences.toMutablePreferences();
+                    mutablePreferences.remove(AUTH_STATE_KEY);
+                    return Single.just(mutablePreferences);
+                })
+                .blockingGet();
+        } catch (Exception e) {
+            Log.e(TAG, "Failed to clear encrypted auth state", e);
+        }
+        clearLegacyAuthState();
+    }
+
+    private static RxDataStore<Preferences> getDataStore(Context context) {
+        synchronized (DATASTORE_LOCK) {
+            if (dataStore == null) {
+                dataStore = new RxPreferenceDataStoreBuilder(context, DATASTORE_NAME).build();
+            }
+            return dataStore;
+        }
+    }
+
+    private String encrypt(String stateJson) throws GeneralSecurityException {
+        byte[] ciphertext = aead.encrypt(stateJson.getBytes(StandardCharsets.UTF_8), associatedData());
+        return Base64.encodeToString(ciphertext, Base64.NO_WRAP);
+    }
+
+    private String decrypt(String encryptedState) throws GeneralSecurityException {
+        byte[] ciphertext = Base64.decode(encryptedState, Base64.NO_WRAP);
+        byte[] plaintext = aead.decrypt(ciphertext, associatedData());
+        return new String(plaintext, StandardCharsets.UTF_8);
+    }
+
+    private byte[] associatedData() {
+        return (context.getPackageName() + ":" + DATASTORE_NAME + ":" + KEY_AUTH_STATE).getBytes(
+            StandardCharsets.UTF_8
+        );
+    }
+
+    @Nullable
+    private String readLegacyAuthState() {
+        return context.getSharedPreferences(LEGACY_PREFS_NAME, Context.MODE_PRIVATE).getString(KEY_AUTH_STATE, null);
+    }
+
+    private void clearLegacyAuthState() {
+        SharedPreferences preferences = context.getSharedPreferences(LEGACY_PREFS_NAME, Context.MODE_PRIVATE);
+        preferences.edit().remove(KEY_AUTH_STATE).apply();
+    }
+}
diff --git a/mobile/keycloak/android/src/main/java/ca/bcgov/plugins/keycloak/Keycloak.java b/mobile/keycloak/android/src/main/java/ca/bcgov/plugins/keycloak/Keycloak.java
index 7713bce8fd..bd59e4ca6f 100644
--- a/mobile/keycloak/android/src/main/java/ca/bcgov/plugins/keycloak/Keycloak.java
+++ b/mobile/keycloak/android/src/main/java/ca/bcgov/plugins/keycloak/Keycloak.java
@@ -2,7 +2,6 @@
 
 import android.content.Context;
 import android.content.Intent;
-import android.content.SharedPreferences;
 import android.net.Uri;
 import android.os.Handler;
 import android.os.Looper;
@@ -10,6 +9,11 @@
 import androidx.annotation.Nullable;
 import com.getcapacitor.JSObject;
 import com.getcapacitor.PluginCall;
+import java.io.IOException;
+import java.security.GeneralSecurityException;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
 import net.openid.appauth.*;
 import org.json.JSONException;
 
@@ -18,58 +22,218 @@ public class Keycloak {
     private static final String TAG = "Keycloak";
     private static final long TOKEN_REFRESH_CHECK_INTERVAL = 60000; // Check every 60 seconds
     private static final long TOKEN_EXPIRY_BUFFER = 60000; // Refresh 1 minute before expiry
-    private static final String PREFS_NAME = "KeycloakAuthState";
-    private static final String KEY_AUTH_STATE = "auth_state";
+    private static final ExecutorService IO_EXECUTOR = Executors.newSingleThreadExecutor();
 
-    private Context context;
     private AuthorizationService authService;
+    private AuthStateStore authStateStore;
     private PluginCall currentCall;
     private AuthorizationRequest currentAuthRequest;
     private AuthState authState;
     private Handler refreshHandler;
     private Runnable refreshCheckRunnable;
     private TokenRefreshCallback tokenRefreshCallback;
+    private CompletableFuture<Void> authStateRestoreFuture;
 
     public interface TokenRefreshCallback {
         void onTokenRefreshed(JSObject tokens);
+
+        void onTokenRefreshFailed(String error);
     }
 
     public Keycloak(Context context) {
-        this.context = context;
         this.authService = new AuthorizationService(context);
-        this.authState = restoreAuthState();
+        this.authStateStore = createAuthStateStore(context);
+        this.authState = new AuthState();
         this.refreshHandler = new Handler(Looper.getMainLooper());
         setupAutomaticRefresh();
+        this.authStateRestoreFuture = restoreAuthStateAsync();
     }
 
-    private AuthState restoreAuthState() {
-        SharedPreferences prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE);
-        String stateJson = prefs.getString(KEY_AUTH_STATE, null);
-
-        if (stateJson != null) {
-            try {
-                AuthState restored = AuthState.jsonDeserialize(stateJson);
-                Log.d(TAG, "Restored auth state from storage");
-                return restored;
-            } catch (JSONException e) {
-                Log.e(TAG, "Failed to restore auth state", e);
-            }
+    private CompletableFuture<Void> restoreAuthStateAsync() {
+        if (authStateStore == null) {
+            Log.d(TAG, "No auth state store, creating new");
+            return CompletableFuture.completedFuture(null);
         }
 
-        Log.d(TAG, "No saved auth state, creating new");
-        return new AuthState();
+        return CompletableFuture
+            .supplyAsync(authStateStore::read, IO_EXECUTOR)
+            .thenCompose(stateJson -> {
+                if (stateJson == null) {
+                    Log.d(TAG, "No saved auth state, creating new");
+                    return CompletableFuture.completedFuture(null);
+                }
+
+                AuthState restoredAuthState;
+                try {
+                    restoredAuthState = AuthState.jsonDeserialize(stateJson);
+                } catch (JSONException e) {
+                    Log.e(TAG, "Failed to restore auth state", e);
+                    return CompletableFuture.completedFuture(null);
+                }
+
+                CompletableFuture<Void> mainThreadFuture = new CompletableFuture<>();
+                refreshHandler.post(() -> {
+                    if (!authState.isAuthorized()) {
+                        authState = restoredAuthState;
+                        Log.d(TAG, "Restored auth state from storage");
+                        checkAndRefreshToken();
+                    }
+                    mainThreadFuture.complete(null);
+                });
+                return mainThreadFuture;
+            });
     }
 
     private void persistAuthState() {
-        SharedPreferences prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE);
-        prefs.edit().putString(KEY_AUTH_STATE, authState.jsonSerializeString()).apply();
-        Log.d(TAG, "Auth state persisted");
+        if (authStateStore != null) {
+            String stateJson = authState.jsonSerializeString();
+            IO_EXECUTOR.execute(() -> authStateStore.write(stateJson));
+        }
+    }
+
+    private void clearAuthState() {
+        if (authStateStore != null) {
+            IO_EXECUTOR.execute(() -> authStateStore.clear());
+        }
+        authState = new AuthState();
+        Log.d(TAG, "Auth state cleared");
+    }
+
+    private AuthStateStore createAuthStateStore(Context context) {
+        try {
+            return new AuthStateStore(context);
+        } catch (GeneralSecurityException | IOException e) {
+            Log.e(TAG, "Failed to initialize encrypted auth state storage", e);
+            return null;
+        }
+    }
+
+    private JSObject createSuccessResponse(
+        @Nullable String accessToken,
+        @Nullable String idToken,
+        @Nullable String tokenType,
+        @Nullable Long expiresAt,
+        @Nullable String scope
+    ) {
+        JSObject successResponse = new JSObject();
+        successResponse.put("isAuthenticated", true);
+        successResponse.put("accessToken", accessToken);
+        successResponse.put("refreshToken", authState.getRefreshToken());
+        successResponse.put("idToken", idToken);
+        successResponse.put("tokenType", tokenType != null ? tokenType : "Bearer");
+        successResponse.put("scope", scope);
+        if (expiresAt != null) {
+            successResponse.put("expiresAt", expiresAt);
+        }
+        return successResponse;
     }
 
     public void setTokenRefreshCallback(TokenRefreshCallback callback) {
         this.tokenRefreshCallback = callback;
     }
 
+    public boolean authenticateWithStoredState(PluginCall call, Runnable fallbackToBrowser) {
+        if (authStateRestoreFuture != null && !authStateRestoreFuture.isDone()) {
+            authStateRestoreFuture.whenComplete((result, error) ->
+                refreshHandler.post(() -> {
+                    if (!authenticateWithStoredState(call, fallbackToBrowser)) {
+                        fallbackToBrowser.run();
+                    }
+                })
+            );
+            return true;
+        }
+
+        if (!authState.isAuthorized()) {
+            Log.d(TAG, "No authorized stored auth state available");
+            return false;
+        }
+
+        Log.d(TAG, "Refreshing stored auth state before launching browser");
+        authState.performActionWithFreshTokens(
+            authService,
+            new AuthState.AuthStateAction() {
+                @Override
+                public void execute(
+                    @Nullable String accessToken,
+                    @Nullable String idToken,
+                    @Nullable AuthorizationException exception
+                ) {
+                    if (exception != null) {
+                        Log.e(TAG, "Stored auth state refresh failed: " + exception.getMessage());
+                        clearAuthState();
+                        fallbackToBrowser.run();
+                        return;
+                    }
+
+                    Log.d(TAG, "Stored auth state refresh successful");
+                    persistAuthState();
+                    call.resolve(
+                        createSuccessResponse(
+                            accessToken,
+                            idToken,
+                            "Bearer",
+                            authState.getAccessTokenExpirationTime(),
+                            authState.getScope()
+                        )
+                    );
+                }
+            }
+        );
+
+        return true;
+    }
+
+    public void refreshStoredAuthState(PluginCall call) {
+        if (!authState.isAuthorized()) {
+            JSObject response = new JSObject();
+            response.put("isAuthenticated", false);
+            response.put("error", "not_authenticated");
+            response.put("errorDescription", "No authorized stored auth state available");
+            call.resolve(response);
+            return;
+        }
+
+        Log.d(TAG, "Refreshing stored auth state");
+        authState.performActionWithFreshTokens(
+            authService,
+            new AuthState.AuthStateAction() {
+                @Override
+                public void execute(
+                    @Nullable String accessToken,
+                    @Nullable String idToken,
+                    @Nullable AuthorizationException exception
+                ) {
+                    if (exception != null) {
+                        Log.e(TAG, "Stored auth state refresh failed: " + exception.getMessage());
+                        clearAuthState();
+                        JSObject response = new JSObject();
+                        response.put("isAuthenticated", false);
+                        response.put("error", exception.error);
+                        response.put("errorDescription", exception.getLocalizedMessage());
+                        call.resolve(response);
+                        return;
+                    }
+
+                    persistAuthState();
+                    call.resolve(
+                        createSuccessResponse(
+                            accessToken,
+                            idToken,
+                            "Bearer",
+                            authState.getAccessTokenExpirationTime(),
+                            authState.getScope()
+                        )
+                    );
+                }
+            }
+        );
+    }
+
+    public void clearStoredAuthState() {
+        clearAuthState();
+    }
+
     private void setupAutomaticRefresh() {
         refreshCheckRunnable = new Runnable() {
             @Override
@@ -79,8 +243,26 @@ public void run() {
                 refreshHandler.postDelayed(this, TOKEN_REFRESH_CHECK_INTERVAL);
             }
         };
-        // Start checking after initial delay
+        resumeAutomaticRefresh();
+    }
+
+    public void pauseAutomaticRefresh() {
+        if (refreshHandler != null && refreshCheckRunnable != null) {
+            refreshHandler.removeCallbacks(refreshCheckRunnable);
+            Log.d(TAG, "Paused automatic token refresh");
+        }
+    }
+
+    public void resumeAutomaticRefresh() {
+        if (refreshHandler == null || refreshCheckRunnable == null) {
+            return;
+        }
+
+        pauseAutomaticRefresh();
+        checkAndRefreshToken();
+        // schedule checks only while the app is in the foreground
         refreshHandler.postDelayed(refreshCheckRunnable, TOKEN_REFRESH_CHECK_INTERVAL);
+        Log.d(TAG, "Resumed automatic token refresh");
     }
 
     private void checkAndRefreshToken() {
@@ -115,6 +297,9 @@ public void execute(
                 ) {
                     if (exception != null) {
                         Log.e(TAG, "Automatic token refresh failed: " + exception.getMessage());
+                        if (tokenRefreshCallback != null) {
+                            tokenRefreshCallback.onTokenRefreshFailed(exception.getLocalizedMessage());
+                        }
                         return;
                     }
 
@@ -130,6 +315,7 @@ public void execute(
                         tokens.put("idToken", idToken);
                         tokens.put("refreshToken", authState.getRefreshToken());
                         tokens.put("tokenType", "Bearer");
+                        tokens.put("scope", authState.getScope());
                         if (authState.getAccessTokenExpirationTime() != null) {
                             tokens.put("expiresAt", authState.getAccessTokenExpirationTime());
                         }
@@ -268,15 +454,13 @@ public void onTokenRequestCompleted(
                         persistAuthState();
 
                         Log.d(TAG, "Token exchange successful");
-                        JSObject successResponse = new JSObject();
-                        successResponse.put("isAuthenticated", true);
-                        successResponse.put("accessToken", tokenResponse.accessToken);
-                        successResponse.put("refreshToken", tokenResponse.refreshToken);
-                        successResponse.put("idToken", tokenResponse.idToken);
-                        successResponse.put("tokenType", tokenResponse.tokenType);
-                        if (tokenResponse.accessTokenExpirationTime != null) {
-                            successResponse.put("expiresAt", tokenResponse.accessTokenExpirationTime);
-                        }
+                        JSObject successResponse = createSuccessResponse(
+                            tokenResponse.accessToken,
+                            tokenResponse.idToken,
+                            tokenResponse.tokenType,
+                            tokenResponse.accessTokenExpirationTime,
+                            tokenResponse.scope
+                        );
 
                         if (currentCall != null) {
                             currentCall.resolve(successResponse);
@@ -312,11 +496,7 @@ public void handleAuthCallback(Uri callbackUri) {
      * Clean up resources
      */
     public void dispose() {
-        // Stop automatic refresh checking
-        if (refreshHandler != null && refreshCheckRunnable != null) {
-            refreshHandler.removeCallbacks(refreshCheckRunnable);
-            Log.d(TAG, "Stopped automatic token refresh");
-        }
+        pauseAutomaticRefresh();
 
         if (authService != null) {
             authService.dispose();
diff --git a/mobile/keycloak/android/src/main/java/ca/bcgov/plugins/keycloak/KeycloakPlugin.java b/mobile/keycloak/android/src/main/java/ca/bcgov/plugins/keycloak/KeycloakPlugin.java
index 0f0c60fd83..65a072c268 100644
--- a/mobile/keycloak/android/src/main/java/ca/bcgov/plugins/keycloak/KeycloakPlugin.java
+++ b/mobile/keycloak/android/src/main/java/ca/bcgov/plugins/keycloak/KeycloakPlugin.java
@@ -43,6 +43,14 @@ public void onTokenRefreshed(JSObject tokens) {
                     Log.d(TAG, "Notifying JavaScript of token refresh");
                     notifyListeners("tokenRefresh", tokens);
                 }
+
+                @Override
+                public void onTokenRefreshFailed(String error) {
+                    Log.d(TAG, "Notifying JavaScript of token refresh failure");
+                    JSObject errorResponse = new JSObject();
+                    errorResponse.put("error", error);
+                    notifyListeners("tokenRefreshFailed", errorResponse);
+                }
             }
         );
 
@@ -70,9 +78,19 @@ public void handleAuthorizationResponse(Intent intent) {
     @Override
     protected void handleOnResume() {
         super.handleOnResume();
-        // MainActivity now handles all authorization responses via onCreate/onNewIntent
-        // This handler is left empty to avoid duplicate processing
-        Log.d(TAG, "App resumed - MainActivity handles authorization responses");
+        if (implementation != null) {
+            implementation.resumeAutomaticRefresh();
+        }
+        Log.d(TAG, "App resumed - automatic token refresh resumed");
+    }
+
+    @Override
+    protected void handleOnPause() {
+        if (implementation != null) {
+            implementation.pauseAutomaticRefresh();
+        }
+        Log.d(TAG, "App paused - automatic token refresh paused");
+        super.handleOnPause();
     }
 
     @Override
@@ -83,6 +101,17 @@ protected void handleOnNewIntent(Intent intent) {
         Log.d(TAG, "New intent received - MainActivity handles authorization responses");
     }
 
+    @PluginMethod
+    public void clearAuthState(PluginCall call) {
+        implementation.clearStoredAuthState();
+        call.resolve();
+    }
+
+    @PluginMethod
+    public void refreshAuthState(PluginCall call) {
+        implementation.refreshStoredAuthState(call);
+    }
+
     @PluginMethod
     public void authenticate(PluginCall call) {
         JSObject options = call.getData();
@@ -110,6 +139,20 @@ public void authenticate(PluginCall call) {
             return;
         }
 
+        if (
+            implementation.authenticateWithStoredState(
+                call,
+                new Runnable() {
+                    @Override
+                    public void run() {
+                        authenticate(call);
+                    }
+                }
+            )
+        ) {
+            return;
+        }
+
         try {
             // Create service configuration
             AuthorizationServiceConfiguration serviceConfig = new AuthorizationServiceConfiguration(
@@ -126,7 +169,7 @@ public void authenticate(PluginCall call) {
             );
 
             authRequestBuilder
-                .setScope("openid profile")
+                .setScope("openid profile offline_access")
                 .setCodeVerifier(CodeVerifierUtil.generateRandomCodeVerifier());
 
             AuthorizationRequest authRequest = authRequestBuilder.build();
@@ -136,7 +179,7 @@ public void authenticate(PluginCall call) {
             Log.d(TAG, "Authorization URL: " + authorizationBaseUrl);
             Log.d(TAG, "Token Endpoint: " + accessTokenEndpoint);
             Log.d(TAG, "Redirect URL: " + redirectUrl);
-            Log.d(TAG, "Scope: openid profile");
+            Log.d(TAG, "Scope: openid profile offline_access");
 
             // Store the call and request for later completion
             implementation.setCurrentCall(call);
diff --git a/mobile/keycloak/android/src/test/java/ca/bcgov/plugins/keycloak/AuthStateStoreTest.java b/mobile/keycloak/android/src/test/java/ca/bcgov/plugins/keycloak/AuthStateStoreTest.java
new file mode 100644
index 0000000000..1e5fdb82c6
--- /dev/null
+++ b/mobile/keycloak/android/src/test/java/ca/bcgov/plugins/keycloak/AuthStateStoreTest.java
@@ -0,0 +1,92 @@
+package ca.bcgov.plugins.keycloak;
+
+import static org.junit.Assert.*;
+
+import android.content.Context;
+import android.content.SharedPreferences;
+import androidx.datastore.preferences.core.Preferences;
+import androidx.datastore.preferences.core.PreferencesKeys;
+import androidx.datastore.rxjava3.RxDataStore;
+import androidx.test.core.app.ApplicationProvider;
+import java.lang.reflect.Field;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.robolectric.RobolectricTestRunner;
+import org.robolectric.annotation.Config;
+
+@RunWith(RobolectricTestRunner.class)
+@Config(sdk = 23, manifest = Config.NONE)
+public class AuthStateStoreTest {
+
+    private static final String KEY_AUTH_STATE = "auth_state";
+    private static final String LEGACY_PREFS_NAME = "KeycloakAuthState";
+    private static final Preferences.Key<String> AUTH_STATE_KEY = PreferencesKeys.stringKey(KEY_AUTH_STATE);
+
+    private Context context;
+    private AuthStateStore store;
+
+    @Before
+    public void setUp() throws Exception {
+        context = ApplicationProvider.getApplicationContext();
+        store = new AuthStateStore(context);
+        store.clear();
+        legacyPreferences().edit().clear().commit();
+    }
+
+    @Test
+    public void testWriteAndRead_roundTripsAuthState() throws Exception {
+        String stateJson = "{\"authorized\":true,\"refreshToken\":\"refresh-token\"}";
+
+        assertTrue(store.write(stateJson));
+
+        assertEquals(stateJson, store.read());
+    }
+
+    @Test
+    public void testWrite_storesEncryptedAuthState() throws Exception {
+        String stateJson = "{\"authorized\":true,\"refreshToken\":\"refresh-token\"}";
+
+        assertTrue(store.write(stateJson));
+
+        String rawStoredValue = getRawStoredValue();
+        assertNotNull(rawStoredValue);
+        assertNotEquals(stateJson, rawStoredValue);
+    }
+
+    @Test
+    public void testRead_migratesLegacyAuthState() throws Exception {
+        String legacyStateJson = "{\"authorized\":true,\"refreshToken\":\"legacy-refresh-token\"}";
+        legacyPreferences().edit().putString(KEY_AUTH_STATE, legacyStateJson).commit();
+
+        assertEquals(legacyStateJson, store.read());
+
+        assertNull(legacyPreferences().getString(KEY_AUTH_STATE, null));
+        assertEquals(legacyStateJson, store.read());
+    }
+
+    @Test
+    public void testClear_removesStoredAndLegacyAuthState() throws Exception {
+        String stateJson = "{\"authorized\":true,\"refreshToken\":\"refresh-token\"}";
+        assertTrue(store.write(stateJson));
+        legacyPreferences().edit().putString(KEY_AUTH_STATE, stateJson).commit();
+
+        store.clear();
+
+        assertNull(store.read());
+        assertNull(legacyPreferences().getString(KEY_AUTH_STATE, null));
+    }
+
+    private SharedPreferences legacyPreferences() {
+        return context.getSharedPreferences(LEGACY_PREFS_NAME, Context.MODE_PRIVATE);
+    }
+
+    @SuppressWarnings("unchecked")
+    private String getRawStoredValue() throws Exception {
+        Field dataStoreField = AuthStateStore.class.getDeclaredField("dataStore");
+        dataStoreField.setAccessible(true);
+        RxDataStore<Preferences> dataStore = (RxDataStore<Preferences>) dataStoreField.get(null);
+        Preferences preferences = dataStore.data().firstOrError().blockingGet();
+        return preferences.get(AUTH_STATE_KEY);
+    }
+}
diff --git a/mobile/keycloak/ios/Sources/KeycloakPlugin/KeycloakPlugin.swift b/mobile/keycloak/ios/Sources/KeycloakPlugin/KeycloakPlugin.swift
index 97d288426a..5f7e9b9629 100644
--- a/mobile/keycloak/ios/Sources/KeycloakPlugin/KeycloakPlugin.swift
+++ b/mobile/keycloak/ios/Sources/KeycloakPlugin/KeycloakPlugin.swift
@@ -16,6 +16,8 @@ public class KeycloakPlugin: CAPPlugin, CAPBridgedPlugin {
     private var authState: OIDAuthState?
     private let logger = Logger(subsystem: "com.bcgov.wps.keycloak", category: "authentication")
     private var tokenRefreshThreshold: TimeInterval = 60  // 1 minute before expiration
+    private var isAppInBackground = false
+    private var lifecycleObservers: [NSObjectProtocol] = []
 
     // Services for dependency injection
     private let services: KeycloakServices
@@ -23,7 +25,9 @@ public class KeycloakPlugin: CAPPlugin, CAPBridgedPlugin {
     public let identifier = "KeycloakPlugin"
     public let jsName = "Keycloak"
     public let pluginMethods: [CAPPluginMethod] = [
-        CAPPluginMethod(name: "authenticate", returnType: CAPPluginReturnPromise)
+        CAPPluginMethod(name: "authenticate", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "refreshAuthState", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "clearAuthState", returnType: CAPPluginReturnPromise),
     ]
 
     // Default initializer uses default services
@@ -38,6 +42,24 @@ public class KeycloakPlugin: CAPPlugin, CAPBridgedPlugin {
         super.init()
     }
 
+    public override func load() {
+        super.load()
+        registerLifecycleObservers()
+
+        guard let restoredAuthState = services.authStateStorageService.loadAuthState() else {
+            return
+        }
+
+        if restoredAuthState.isAuthorized {
+            authState = restoredAuthState
+            if !isAppInBackground {
+                startTokenRefreshManager(authState: restoredAuthState)
+            }
+        } else {
+            services.authStateStorageService.clearAuthState()
+        }
+    }
+
     @objc func authenticate(_ call: CAPPluginCall) {
         // Validate parameters using the injected validator
         let validationResult = services.parameterValidator.validateAuthenticationParameters(call)
@@ -51,6 +73,109 @@ public class KeycloakPlugin: CAPPlugin, CAPBridgedPlugin {
             return
         }
 
+        if let existingAuthState = authState ?? services.authStateStorageService.loadAuthState() {
+            if existingAuthState.isAuthorized {
+                refreshExistingAuthState(
+                    authState: existingAuthState,
+                    call: call,
+                    fallbackAuthenticationParameters: parameters
+                )
+                return
+            }
+
+            authState = nil
+            services.authStateStorageService.clearAuthState()
+        }
+
+        performAuthentication(parameters: parameters, call: call)
+    }
+
+    @objc func clearAuthState(_ call: CAPPluginCall) {
+        clearStoredAuthState()
+        call.resolve()
+    }
+
+    @objc func refreshAuthState(_ call: CAPPluginCall) {
+        guard let existingAuthState = authState ?? services.authStateStorageService.loadAuthState()
+        else {
+            call.resolve([
+                "isAuthenticated": false,
+                "error": "not_authenticated",
+                "errorDescription": "No stored auth state available",
+            ])
+            return
+        }
+
+        guard existingAuthState.isAuthorized else {
+            clearStoredAuthState()
+            call.resolve([
+                "isAuthenticated": false,
+                "error": "not_authenticated",
+                "errorDescription": "No authorized stored auth state available",
+            ])
+            return
+        }
+
+        refreshStoredAuthState(
+            authState: existingAuthState,
+            onSuccess: { response in
+                call.resolve(response)
+            },
+            onFailure: { [weak self] error in
+                guard let self = self else { return }
+                self.clearStoredAuthState()
+                call.resolve([
+                    "isAuthenticated": false,
+                    "error": "refresh_failed",
+                    "errorDescription": error ?? "Failed to refresh stored auth state",
+                ])
+            }
+        )
+    }
+
+    private func refreshExistingAuthState(
+        authState: OIDAuthState,
+        call: CAPPluginCall,
+        fallbackAuthenticationParameters parameters: AuthenticationParameters
+    ) {
+        refreshStoredAuthState(
+            authState: authState,
+            onSuccess: { response in
+                call.resolve(response)
+            },
+            onFailure: { [weak self] _ in
+                guard let self = self else { return }
+                self.authState = nil
+                self.services.authStateStorageService.clearAuthState()
+                self.performAuthentication(parameters: parameters, call: call)
+            }
+        )
+    }
+
+    private func refreshStoredAuthState(
+        authState: OIDAuthState,
+        onSuccess: @escaping ([String: Any]) -> Void,
+        onFailure: @escaping (String?) -> Void
+    ) {
+        services.tokenRefreshService.performTokenRefresh(authState: authState) {
+            [weak self] success, tokenResponse, error in
+            guard let self = self else { return }
+
+            if success {
+                self.authState = authState
+                self.services.authStateStorageService.saveAuthState(authState)
+                self.startTokenRefreshManager(authState: authState)
+                let response =
+                    tokenResponse
+                    ?? self.services.tokenResponseService.createTokenResponse(from: authState)
+                onSuccess(response)
+            } else {
+                onFailure(error)
+            }
+        }
+    }
+
+    private func performAuthentication(parameters: AuthenticationParameters, call: CAPPluginCall) {
         services.authenticationFlowService.performAuthenticationFlow(
             parameters: parameters,
             call: call
@@ -60,23 +185,127 @@ public class KeycloakPlugin: CAPPlugin, CAPBridgedPlugin {
             self.authState = authState
 
             if let authState = authState {
-                self.services.tokenRefreshManagerService.startTokenRefreshManager(
-                    authState: authState,
-                    tokenRefreshThreshold: self.tokenRefreshThreshold,
-                    onTokenRefreshed: { [weak self] tokenResponse in
-                        // Notify JavaScript layer about token refresh
-                        self?.notifyListeners("tokenRefresh", data: tokenResponse)
-                    },
-                    onTokenRefreshFailed: { [weak self] error in
-                        // Notify JavaScript layer about refresh failure
-                        self?.notifyListeners("tokenRefreshFailed", data: ["error": error])
-                    }
+                self.services.authStateStorageService.saveAuthState(authState)
+                self.startTokenRefreshManager(authState: authState)
+            }
+        }
+    }
+
+    private func startTokenRefreshManager(authState: OIDAuthState) {
+        guard !isAppInBackground else {
+            return
+        }
+
+        services.tokenRefreshManagerService.startTokenRefreshManager(
+            authState: authState,
+            tokenRefreshThreshold: tokenRefreshThreshold,
+            onTokenRefreshed: { [weak self, weak authState] tokenResponse in
+                if let authState = authState {
+                    self?.services.authStateStorageService.saveAuthState(authState)
+                }
+                // notify JavaScript layer about token refresh
+                self?.notifyListeners("tokenRefresh", data: tokenResponse)
+            },
+            onTokenRefreshFailed: { [weak self] error in
+                // notify JavaScript layer about refresh failure
+                self?.notifyListeners("tokenRefreshFailed", data: ["error": error])
+            }
+        )
+    }
+
+    private func registerLifecycleObservers() {
+        removeLifecycleObservers()
+
+        let notificationCenter = NotificationCenter.default
+        lifecycleObservers = [
+            notificationCenter.addObserver(
+                forName: UIApplication.didEnterBackgroundNotification,
+                object: nil,
+                queue: .main
+            ) { [weak self] _ in
+                self?.handleAppDidEnterBackground()
+            },
+            notificationCenter.addObserver(
+                forName: UIApplication.didBecomeActiveNotification,
+                object: nil,
+                queue: .main
+            ) { [weak self] _ in
+                self?.handleAppDidBecomeActive()
+            },
+        ]
+    }
+
+    private func removeLifecycleObservers() {
+        lifecycleObservers.forEach(NotificationCenter.default.removeObserver)
+        lifecycleObservers.removeAll()
+    }
+
+    private func handleAppDidEnterBackground() {
+        isAppInBackground = true
+        services.tokenRefreshManagerService.stopTokenRefreshManager()
+        logger.debug("App entered background - automatic token refresh stopped")
+    }
+
+    private func handleAppDidBecomeActive() {
+        isAppInBackground = false
+        resumeStoredAuthStateOnForeground()
+    }
+
+    private func resumeStoredAuthStateOnForeground() {
+        guard let existingAuthState = authState ?? services.authStateStorageService.loadAuthState()
+        else {
+            return
+        }
+
+        guard existingAuthState.isAuthorized else {
+            authState = nil
+            services.authStateStorageService.clearAuthState()
+            return
+        }
+
+        if !shouldRefresh(authState: existingAuthState) {
+            authState = existingAuthState
+            startTokenRefreshManager(authState: existingAuthState)
+            return
+        }
+
+        services.tokenRefreshService.performTokenRefresh(authState: existingAuthState) {
+            [weak self] success, tokenResponse, error in
+            guard let self = self, !self.isAppInBackground else { return }
+
+            if success {
+                self.authState = existingAuthState
+                self.services.authStateStorageService.saveAuthState(existingAuthState)
+                self.startTokenRefreshManager(authState: existingAuthState)
+                if let tokenResponse = tokenResponse {
+                    self.notifyListeners("tokenRefresh", data: tokenResponse)
+                }
+            } else {
+                self.clearStoredAuthState()
+                self.notifyListeners(
+                    "tokenRefreshFailed",
+                    data: ["error": error ?? "Failed to refresh stored auth state"]
                 )
             }
         }
     }
 
+    private func shouldRefresh(authState: OIDAuthState) -> Bool {
+        guard let expirationDate = authState.lastTokenResponse?.accessTokenExpirationDate else {
+            return false
+        }
+
+        return expirationDate.timeIntervalSinceNow <= tokenRefreshThreshold
+    }
+
+    private func clearStoredAuthState() {
+        authState = nil
+        services.authStateStorageService.clearAuthState()
+        services.tokenRefreshManagerService.stopTokenRefreshManager()
+    }
+
     deinit {
+        removeLifecycleObservers()
         services.tokenRefreshManagerService.stopTokenRefreshManager()
     }
 }
diff --git a/mobile/keycloak/ios/Sources/KeycloakPlugin/KeycloakServices.swift b/mobile/keycloak/ios/Sources/KeycloakPlugin/KeycloakServices.swift
index 66091cd261..d63e256f44 100644
--- a/mobile/keycloak/ios/Sources/KeycloakPlugin/KeycloakServices.swift
+++ b/mobile/keycloak/ios/Sources/KeycloakPlugin/KeycloakServices.swift
@@ -2,6 +2,7 @@ import AppAuth
 import Capacitor
 import Foundation
 import OSLog
+import Security
 
 #if canImport(UIKit)
     import UIKit
@@ -47,6 +48,13 @@ public protocol TokenResponseServiceProtocol {
     func createTokenResponse(from authState: OIDAuthState) -> [String: Any]
 }
 
+/// Protocol for persisting AppAuth state
+public protocol AuthStateStorageServiceProtocol {
+    func saveAuthState(_ authState: OIDAuthState)
+    func loadAuthState() -> OIDAuthState?
+    func clearAuthState()
+}
+
 /// Protocol for UI operations
 public protocol UIServiceProtocol {
     func getAppDelegate() -> KeycloakAppDelegate?
@@ -268,6 +276,9 @@ public class DefaultTokenRefreshService: TokenRefreshServiceProtocol {
                 completion(false, nil, error.localizedDescription)
             } else {
                 self?.logger.debug("Token refresh successful")
+                self?.logger.debug(
+                    "Token refresh scope: \(authState.lastTokenResponse?.scope ?? "nil")"
+                )
 
                 let tokenResponse = DefaultTokenResponseService().createTokenResponse(
                     from: authState)
@@ -294,6 +305,97 @@ public class DefaultTokenResponseService: TokenResponseServiceProtocol {
     }
 }
 
+/// Keychain-backed implementation of AuthStateStorageServiceProtocol
+public class KeychainAuthStateStorageService: AuthStateStorageServiceProtocol {
+    private let service: String
+    private let account: String
+    private let logger = Logger(subsystem: "com.bcgov.wps.keycloak", category: "auth-state-storage")
+
+    public init(
+        service: String = "com.bcgov.wps.keycloak",
+        account: String = "oid-auth-state"
+    ) {
+        self.service = service
+        self.account = account
+    }
+
+    public func saveAuthState(_ authState: OIDAuthState) {
+        do {
+            let data = try NSKeyedArchiver.archivedData(
+                withRootObject: authState,
+                requiringSecureCoding: true
+            )
+
+            let query = baseQuery()
+            let attributes: [String: Any] = [
+                kSecValueData as String: data,
+                kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly,
+            ]
+
+            let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
+            if updateStatus == errSecItemNotFound {
+                var addQuery = query
+                addQuery[kSecValueData as String] = data
+                addQuery[kSecAttrAccessible as String] =
+                    kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+
+                let addStatus = SecItemAdd(addQuery as CFDictionary, nil)
+                if addStatus != errSecSuccess {
+                    logger.error("Failed to add auth state to keychain: \(addStatus)")
+                }
+            } else if updateStatus != errSecSuccess {
+                logger.error("Failed to update auth state in keychain: \(updateStatus)")
+            }
+        } catch {
+            logger.error("Failed to archive auth state: \(error.localizedDescription)")
+        }
+    }
+
+    public func loadAuthState() -> OIDAuthState? {
+        var query = baseQuery()
+        query[kSecReturnData as String] = true
+        query[kSecMatchLimit as String] = kSecMatchLimitOne
+
+        var result: AnyObject?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+
+        guard status == errSecSuccess else {
+            if status != errSecItemNotFound {
+                logger.error("Failed to load auth state from keychain: \(status)")
+            }
+            return nil
+        }
+
+        guard let data = result as? Data else {
+            logger.error("Stored auth state was not keychain data")
+            return nil
+        }
+
+        do {
+            return try NSKeyedUnarchiver.unarchivedObject(ofClass: OIDAuthState.self, from: data)
+        } catch {
+            logger.error("Failed to unarchive auth state: \(error.localizedDescription)")
+            clearAuthState()
+            return nil
+        }
+    }
+
+    public func clearAuthState() {
+        let status = SecItemDelete(baseQuery() as CFDictionary)
+        if status != errSecSuccess && status != errSecItemNotFound {
+            logger.error("Failed to clear auth state from keychain: \(status)")
+        }
+    }
+
+    private func baseQuery() -> [String: Any] {
+        [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: service,
+            kSecAttrAccount as String: account,
+        ]
+    }
+}
+
 /// Default implementation of UIServiceProtocol
 public class DefaultUIService: UIServiceProtocol {
     public init() {}
@@ -459,6 +561,7 @@ public class DefaultAuthenticationFlowService: AuthenticationFlowServiceProtocol
             logger.debug(
                 "Got authorization tokens. Access token: \(authState.lastTokenResponse?.accessToken ?? "nil", privacy: .private)"
             )
+            logger.debug("Authorization scope: \(authState.lastTokenResponse?.scope ?? "nil")")
 
             completion(authState)
         } else {
@@ -546,6 +649,7 @@ public struct KeycloakServices {
     public let tokenRefreshService: TokenRefreshServiceProtocol
     public let tokenRefreshManagerService: TokenRefreshManagerServiceProtocol
     public let tokenResponseService: TokenResponseServiceProtocol
+    public let authStateStorageService: AuthStateStorageServiceProtocol
     public let uiService: UIServiceProtocol
     public let parameterValidator: AuthenticationParameterValidatorProtocol
 
@@ -554,6 +658,8 @@ public struct KeycloakServices {
         tokenTimerService: TokenTimerServiceProtocol = DefaultTokenTimerService(),
         tokenRefreshService: TokenRefreshServiceProtocol = DefaultTokenRefreshService(),
         tokenResponseService: TokenResponseServiceProtocol = DefaultTokenResponseService(),
+        authStateStorageService: AuthStateStorageServiceProtocol =
+            KeychainAuthStateStorageService(),
         uiService: UIServiceProtocol = DefaultUIService(),
         parameterValidator: AuthenticationParameterValidatorProtocol =
             DefaultAuthenticationParameterValidator()
@@ -571,6 +677,7 @@ public struct KeycloakServices {
             tokenRefreshService: tokenRefreshService
         )
         self.tokenResponseService = tokenResponseService
+        self.authStateStorageService = authStateStorageService
         self.uiService = uiService
         self.parameterValidator = parameterValidator
     }
diff --git a/mobile/keycloak/ios/Tests/KeycloakPluginTests/KeycloakPluginTests.swift b/mobile/keycloak/ios/Tests/KeycloakPluginTests/KeycloakPluginTests.swift
index f99274b94c..bcce54f6bd 100644
--- a/mobile/keycloak/ios/Tests/KeycloakPluginTests/KeycloakPluginTests.swift
+++ b/mobile/keycloak/ios/Tests/KeycloakPluginTests/KeycloakPluginTests.swift
@@ -2,6 +2,7 @@ import AppAuth
 import Capacitor
 import Foundation
 import Testing
+import UIKit
 
 @testable import KeycloakPlugin
 
@@ -24,7 +25,9 @@ struct KeycloakPluginTests {
     @Test func testPluginMethods() {
         let methodNames = plugin.pluginMethods.map { $0.name }
         #expect(methodNames.contains("authenticate"))
-        #expect(plugin.pluginMethods.count == 1)
+        #expect(methodNames.contains("refreshAuthState"))
+        #expect(methodNames.contains("clearAuthState"))
+        #expect(plugin.pluginMethods.count == 3)
     }
 
     @Test func testPluginMethodReturnTypes() {
@@ -64,7 +67,7 @@ struct KeycloakPluginTests {
 
         #expect(pluginWithServices.identifier == "KeycloakPlugin")
         #expect(pluginWithServices.jsName == "Keycloak")
-        #expect(pluginWithServices.pluginMethods.count == 1)
+        #expect(pluginWithServices.pluginMethods.map { $0.name } == ["authenticate", "refreshAuthState", "clearAuthState"])
     }
 
     @Test func testDefaultServicesInitialization() {
@@ -76,6 +79,7 @@ struct KeycloakPluginTests {
         #expect(services.tokenTimerService is DefaultTokenTimerService)
         #expect(services.tokenRefreshService is DefaultTokenRefreshService)
         #expect(services.tokenResponseService is DefaultTokenResponseService)
+        #expect(services.authStateStorageService is KeychainAuthStateStorageService)
         #expect(services.uiService is DefaultUIService)
     }
 
@@ -102,4 +106,108 @@ struct KeycloakPluginTests {
         return OIDAuthState(
             authorizationResponse: nil, tokenResponse: nil, registrationResponse: nil)
     }
+
+    @Test func testForegroundRefreshFailureClearsStoredAuthState() async throws {
+        let storage = SpyAuthStateStorageService(authState: makeExpiringAuthorizedAuthState())
+        let plugin = KeycloakPlugin(services: KeycloakServices(
+            tokenRefreshService: MockFailingTokenRefreshService(),
+            authStateStorageService: storage
+        ))
+        plugin.load()
+
+        await withCheckedContinuation { (continuation: CheckedContinuation<Void, Never>) in
+            storage.onClearAuthState = { continuation.resume() }
+            NotificationCenter.default.post(
+                name: UIApplication.didBecomeActiveNotification, object: nil)
+        }
+
+        #expect(storage.storedAuthState == nil)
+    }
+
+    private func makeExpiringAuthorizedAuthState() -> OIDAuthState {
+        let config = OIDServiceConfiguration(
+            authorizationEndpoint: URL(string: "https://auth.example.com/auth")!,
+            tokenEndpoint: URL(string: "https://auth.example.com/token")!
+        )
+        let authRequest = OIDAuthorizationRequest(
+            configuration: config,
+            clientId: "test-client",
+            scopes: ["openid"],
+            redirectURL: URL(string: "test://callback")!,
+            responseType: OIDResponseTypeCode,
+            additionalParameters: nil
+        )
+        let authResponse = OIDAuthorizationResponse(
+            request: authRequest,
+            parameters: ["code": "test-code" as NSCopying & NSObjectProtocol]
+        )
+        let tokenRequest = OIDTokenRequest(
+            configuration: config,
+            grantType: OIDGrantTypeAuthorizationCode,
+            authorizationCode: "test-code",
+            redirectURL: URL(string: "test://callback")!,
+            clientID: "test-client",
+            clientSecret: nil,
+            scope: "openid",
+            refreshToken: nil,
+            codeVerifier: nil,
+            additionalParameters: nil
+        )
+        let tokenResponse = OIDTokenResponse(
+            request: tokenRequest,
+            parameters: [
+                "access_token": "test-access-token" as NSCopying & NSObjectProtocol,
+                "refresh_token": "test-refresh-token" as NSCopying & NSObjectProtocol,
+                "token_type": "Bearer" as NSCopying & NSObjectProtocol,
+                "expires_in": NSNumber(value: 30) as NSCopying & NSObjectProtocol,
+            ]
+        )
+        return OIDAuthState(
+            authorizationResponse: authResponse,
+            tokenResponse: tokenResponse,
+            registrationResponse: nil
+        )
+    }
+}
+
+private final class MockFailingTokenRefreshService: TokenRefreshServiceProtocol {
+    func performAutomaticTokenRefresh(
+        authState: OIDAuthState?,
+        onSuccess: @escaping ([String: Any]) -> Void,
+        onFailure: @escaping (String) -> Void,
+        onTokenRefreshed: @escaping () -> Void
+    ) {
+        onFailure("mock-refresh-failed")
+    }
+
+    func performTokenRefresh(
+        authState: OIDAuthState?,
+        completion: @escaping (Bool, [String: Any]?, String?) -> Void
+    ) {
+        completion(false, nil, "mock-refresh-failed")
+    }
+}
+
+private final class SpyAuthStateStorageService: AuthStateStorageServiceProtocol {
+    var storedAuthState: OIDAuthState?
+    var clearAuthStateCalled = false
+    var onClearAuthState: (() -> Void)?
+
+    init(authState: OIDAuthState?) {
+        storedAuthState = authState
+    }
+
+    func saveAuthState(_ authState: OIDAuthState) {
+        storedAuthState = authState
+    }
+
+    func loadAuthState() -> OIDAuthState? {
+        storedAuthState
+    }
+
+    func clearAuthState() {
+        clearAuthStateCalled = true
+        storedAuthState = nil
+        onClearAuthState?()
+    }
 }
diff --git a/mobile/keycloak/src/definitions.ts b/mobile/keycloak/src/definitions.ts
index 3ba706418c..aff494324a 100644
--- a/mobile/keycloak/src/definitions.ts
+++ b/mobile/keycloak/src/definitions.ts
@@ -5,6 +5,14 @@ export interface KeycloakPlugin {
    * @returns {Promise<KeycloakAuthResponse>} the authentication response
    */
   authenticate(options: KeycloakOptions): Promise<KeycloakAuthResponse>
+  /**
+   * Refresh the stored native authentication state without launching browser auth.
+   */
+  refreshAuthState(): Promise<KeycloakAuthResponse>
+  /**
+   * Clear any stored native authentication state.
+   */
+  clearAuthState(): Promise<void>
   /**
    * Add a listener for plugin events, specifically for token refreshes.
    * @param {string} eventName
@@ -107,6 +115,10 @@ export interface KeycloakTokenResponse {
    * The new access token
    */
   accessToken: string
+  /**
+   * The ID token, if provided by the server.
+   */
+  idToken?: string
   /**
    * The new refresh token (if provided)
    */
diff --git a/mobile/keycloak/src/web.ts b/mobile/keycloak/src/web.ts
index 42193782bf..29053868de 100644
--- a/mobile/keycloak/src/web.ts
+++ b/mobile/keycloak/src/web.ts
@@ -12,4 +12,14 @@ export class KeycloakWeb extends WebPlugin {
       errorDescription: 'Not implemented'
     }
   }
+
+  async refreshAuthState(): Promise<KeycloakAuthResponse> {
+    return {
+      isAuthenticated: false,
+      error: 'not_implemented',
+      errorDescription: 'Not implemented'
+    }
+  }
+
+  async clearAuthState(): Promise<void> {}
 }