Store refresh tokens in cookies with HttpOnly (inaccessible to JavaScript), Secure (HTTPS only), SameSite=Strict (sent only to your API) flags and a narrow path. Prevents XSS-driven token theft and simplifies rotation. Works for web and mobile (including Ionic) as long as CORS is set with credentials:true and the front end opts in.