diff --git a/frontend/components/account/AccountCenter.tsx b/frontend/components/account/AccountCenter.tsx
index f7b6c610..39daec2b 100644
--- a/frontend/components/account/AccountCenter.tsx
+++ b/frontend/components/account/AccountCenter.tsx
@@ -646,6 +646,13 @@ export function AccountCenter() {
     } = await client.auth.refreshSession();
     const refreshedToken = String(refreshed?.access_token || "").trim();
     if (refreshedToken) return refreshedToken;
+    if (
+      cachedToken &&
+      Number.isFinite(expiresAtSec) &&
+      expiresAtSec > nowSec
+    ) {
+      return cachedToken;
+    }
     throw new Error(
       error?.message
         ? isEn
diff --git a/frontend/lib/backend-auth.ts b/frontend/lib/backend-auth.ts
index 28e086a6..275def33 100644
--- a/frontend/lib/backend-auth.ts
+++ b/frontend/lib/backend-auth.ts
@@ -51,14 +51,14 @@ export async function buildBackendRequestHeaders(
       headers.set(FORWARDED_SUPABASE_EMAIL_HEADER, forwardedEmail);
     }
 
-    const accessToken = session?.access_token || "";
-    if (accessToken) {
-      // Prefer server-side session token to avoid stale client bearer tokens.
-      headers.set("Authorization", `Bearer ${accessToken}`);
-      return { headers, response: passthroughResponse };
-    }
     if (incomingAuth) {
       headers.set("Authorization", `Bearer ${incomingAuth}`);
+      return { headers, response: passthroughResponse };
+    }
+    const accessToken = session?.access_token || "";
+    if (accessToken) {
+      // Fallback to cookie-backed session when request does not carry bearer.
+      headers.set("Authorization", `Bearer ${accessToken}`);
     }
     return { headers, response: passthroughResponse };
   }
diff --git a/frontend/middleware.ts b/frontend/middleware.ts
index a1bba42d..72008a53 100644
--- a/frontend/middleware.ts
+++ b/frontend/middleware.ts
@@ -94,6 +94,12 @@ async function handleSupabaseAuthGate(request: NextRequest) {
   if (isPublicPage(pathname)) {
     return NextResponse.next();
   }
+  if (pathname.startsWith("/api/")) {
+    const authHeader = String(request.headers.get("authorization") || "").trim();
+    if (/^bearer\s+\S+/i.test(authHeader)) {
+      return NextResponse.next();
+    }
+  }
 
   const response = NextResponse.next({
     request: {