diff --git a/apps/dashboard/.gitignore b/apps/dashboard/.gitignore
index 290bcd476..aed807893 100644
--- a/apps/dashboard/.gitignore
+++ b/apps/dashboard/.gitignore
@@ -5,3 +5,4 @@ dist
 .tanstack
 dev-boot.log
 *.log
+**/.env
diff --git a/apps/dashboard/e2e/auth-gate.spec.ts b/apps/dashboard/e2e/auth-gate.spec.ts
index 11b172d7a..fc99ceb35 100644
--- a/apps/dashboard/e2e/auth-gate.spec.ts
+++ b/apps/dashboard/e2e/auth-gate.spec.ts
@@ -37,6 +37,18 @@ test("a seeded session renders the app shell instead of redirecting", async ({ p
   expect(backend.unexpectedExternalRequests).toEqual([]);
 });
 
+test("an expired access token refreshes before the dashboard renders", async ({ page }) => {
+  const backend = await mockBackend(page, { verifyTokenValid: false });
+  const expiredToken = `header.${Buffer.from(JSON.stringify({ exp: 1 })).toString("base64url")}.signature`;
+  await seedSession(page, expiredToken);
+
+  await page.goto("/overview");
+
+  await expect(page.getByRole("heading", { name: "Onboarding" })).toBeVisible({ timeout: 20_000 });
+  await expect(page).toHaveURL(/\/overview/);
+  expect(backend.auth.refreshes).toBe(1);
+});
+
 test("a started onboarding account renders without crashing the overview", async ({ page }) => {
   await mockBackend(page, { onboardingState: "started" });
   await seedSession(page);
diff --git a/apps/dashboard/e2e/onboarding-alfredpay-mxn.spec.ts b/apps/dashboard/e2e/onboarding-alfredpay-mxn.spec.ts
index 9a697d4da..28e5ab88e 100644
--- a/apps/dashboard/e2e/onboarding-alfredpay-mxn.spec.ts
+++ b/apps/dashboard/e2e/onboarding-alfredpay-mxn.spec.ts
@@ -86,7 +86,7 @@ test("Alfredpay MX KYC: continuing in the background, the card reacts to approva
 
   backend.kyc.approved = true;
   // No interaction, no reload — the 15s onboarding-status refetch flips the card to approved.
-  await expect(page.getByRole("button", { name: "View payout accounts" })).toBeVisible({ timeout: 25_000 });
+  await expect(page.getByRole("button", { name: "View pay-out accounts" })).toBeVisible({ timeout: 25_000 });
 });
 
 test("Alfredpay MX KYC: closing on the details form and reloading keeps the card resumable", async ({ page }) => {
diff --git a/apps/dashboard/e2e/onramp-journeys.spec.ts b/apps/dashboard/e2e/onramp-journeys.spec.ts
index b000c49cc..4ec0932c9 100644
--- a/apps/dashboard/e2e/onramp-journeys.spec.ts
+++ b/apps/dashboard/e2e/onramp-journeys.spec.ts
@@ -13,17 +13,17 @@ const CASES = [
   { currency: "ARS", expected: "CVU" }
 ] as const;
 
-test("transfer modes are route-backed and Cross-border is complete", async ({ page }) => {
+test("transfer modes are route-backed and Fiat-to-Fiat is complete", async ({ page }) => {
   const backend = await mockBackend(page);
   await seedSession(page);
   await page.goto("/transfer");
 
-  await page.getByRole("tab", { name: "Cross-border" }).click();
+  await page.getByRole("tab", { name: "Fiat-to-Fiat" }).click();
   await expect(page).toHaveURL(/mode=cross-border/);
-  await expect(page.getByText("Cross-border transfers are coming soon")).toBeVisible();
+  await expect(page.getByText("Fiat-to-Fiat transfers are coming soon")).toBeVisible();
 
   await page.reload();
-  await expect(page.getByRole("tab", { name: "Cross-border" })).toHaveAttribute("data-state", "active");
+  await expect(page.getByRole("tab", { name: "Fiat-to-Fiat" })).toHaveAttribute("data-state", "active");
   expect(backend.unmatchedRequests).toEqual([]);
   expect(backend.unexpectedExternalRequests).toEqual([]);
 });
@@ -231,7 +231,7 @@ for (const journey of CASES) {
     await page.getByRole("button", { name: "I have made the payment" }).click();
     await expect.poll(() => backend.startRequests.length).toBe(1);
     await expect(page).toHaveURL(/\/transactions/);
-    await expect(page.getByText("Onramp", { exact: true })).toBeVisible();
+    await expect(page.getByText("Pay-in", { exact: true })).toBeVisible();
     expect(backend.unmatchedRequests).toEqual([]);
     expect(backend.unexpectedExternalRequests).toEqual([]);
   });
diff --git a/apps/dashboard/e2e/payout-accounts.spec.ts b/apps/dashboard/e2e/payout-accounts.spec.ts
index 36a771f4b..a960237ea 100644
--- a/apps/dashboard/e2e/payout-accounts.spec.ts
+++ b/apps/dashboard/e2e/payout-accounts.spec.ts
@@ -8,23 +8,23 @@ test("an approved AlfredPay corridor adds a self payout account", async ({ page
   await page.goto("/overview");
 
   const card = page.getByTestId("corridor-card-MX");
-  await expect(card.getByRole("button", { name: "Add payout account" })).toBeVisible({ timeout: 20_000 });
-  await expect(card.getByText(/to enable reception of money through offramps/)).toBeVisible();
+  await expect(card.getByRole("button", { name: "Add pay-out account" })).toBeVisible({ timeout: 20_000 });
+  await expect(card.getByText(/to enable reception of money through pay-outs/)).toBeVisible();
 
   const progress = card.getByRole("progressbar", { name: "Mexico onboarding progress" });
   await expect(progress).toHaveAttribute("aria-valuenow", "90");
   await expect(progress.locator('[data-slot="progress-indicator"]')).toHaveClass(/bg-primary/);
 
-  await card.getByRole("button", { name: "Add payout account" }).click();
+  await card.getByRole("button", { name: "Add pay-out account" }).click();
   const dialog = page.getByRole("dialog");
-  await expect(dialog.getByText(/enables reception of money through offramps/)).toBeVisible();
+  await expect(dialog.getByText(/enables reception of money through pay-outs/)).toBeVisible();
   await dialog.getByLabel("CLABE").fill("646180157000000004");
   await dialog.getByLabel("Account holder name").fill("Vortex E2E CLABE");
-  await dialog.getByRole("button", { name: "Save payout account" }).click();
+  await dialog.getByRole("button", { name: "Save pay-out account" }).click();
 
   await page.keyboard.press("Escape");
   await expect(dialog).toBeHidden();
-  await expect(card.getByRole("button", { name: "View payout accounts" })).toBeVisible();
+  await expect(card.getByRole("button", { name: "View pay-out accounts" })).toBeVisible();
   await expect(progress).toHaveAttribute("aria-valuenow", "100");
   await expect(progress.locator('[data-slot="progress-indicator"]')).toHaveClass(/bg-success/);
   expect(backend.fiatAccountRequests).toEqual([
@@ -55,21 +55,21 @@ test("a provider-rejected payout account surfaces field and form errors instead
   await page.goto("/overview");
 
   const card = page.getByTestId("corridor-card-MX");
-  await card.getByRole("button", { name: "Add payout account" }).click();
+  await card.getByRole("button", { name: "Add pay-out account" }).click();
   const dialog = page.getByRole("dialog");
   await dialog.getByLabel("CLABE").fill("646180157000000004");
   await dialog.getByLabel("Account holder name").fill("Vortex E2E CLABE");
-  await dialog.getByRole("button", { name: "Save payout account" }).click();
+  await dialog.getByRole("button", { name: "Save pay-out account" }).click();
 
   await expect(dialog.getByText("This account number was rejected by the payout provider.")).toBeVisible();
   await expect(
     dialog.getByText("The payout provider rejected this account number. Double-check it and try again.")
   ).toBeVisible();
   // The form stays open for correction and nothing was added.
-  await expect(dialog.getByRole("button", { name: "Save payout account" })).toBeEnabled();
+  await expect(dialog.getByRole("button", { name: "Save pay-out account" })).toBeEnabled();
   await page.keyboard.press("Escape");
   await expect(dialog).toBeHidden();
-  await expect(card.getByRole("button", { name: "Add payout account" })).toBeVisible();
+  await expect(card.getByRole("button", { name: "Add pay-out account" })).toBeVisible();
   expect(backend.fiatAccountRequests).toHaveLength(1);
   expect(backend.unmatchedRequests).toEqual([]);
   expect(backend.unexpectedExternalRequests).toEqual([]);
@@ -91,7 +91,7 @@ test("an approved AlfredPay corridor removes a payout account after confirmation
   await page.goto("/overview");
 
   const card = page.getByTestId("corridor-card-MX");
-  await card.getByRole("button", { name: "View payout accounts" }).click();
+  await card.getByRole("button", { name: "View pay-out accounts" }).click();
   const dialog = page.getByRole("dialog");
   const remove = dialog.getByRole("button", { name: "Remove account ending in 0004" });
   await remove.click();
@@ -104,7 +104,7 @@ test("an approved AlfredPay corridor removes a payout account after confirmation
   await expect(dialog.getByText("Vortex E2E CLABE", { exact: false })).toBeHidden();
   await page.keyboard.press("Escape");
   await expect(dialog).toBeHidden();
-  await expect(card.getByRole("button", { name: "Add payout account" })).toBeVisible();
+  await expect(card.getByRole("button", { name: "Add pay-out account" })).toBeVisible();
   expect(backend.fiatAccountDeleteRequests).toEqual([{ country: "MX", fiatAccountId: "fiat-account-to-delete" }]);
   expect(backend.unmatchedRequests).toEqual([]);
   expect(backend.unexpectedExternalRequests).toEqual([]);
diff --git a/apps/dashboard/e2e/quote-explorer.spec.ts b/apps/dashboard/e2e/quote-explorer.spec.ts
index a31b05e75..15dc36cdf 100644
--- a/apps/dashboard/e2e/quote-explorer.spec.ts
+++ b/apps/dashboard/e2e/quote-explorer.spec.ts
@@ -14,9 +14,13 @@ test("EUR is quotable on BUY and an unapproved corridor routes to onboarding", a
   await expect.poll(() => backend.quoteRequests.length, { timeout: 20_000 }).toBeGreaterThan(0);
   expect(backend.quoteRequests.at(-1)).toMatchObject({ inputCurrency: "EUR", paymentMethod: "sepa", rampType: "BUY" });
 
-  const onboardingCta = page.getByRole("link", { name: "Get approved for Europe" });
+  const onboardingCta = page.getByRole("link", { name: "Start onboarding for Europe" });
   await expect(onboardingCta).toBeVisible({ timeout: 20_000 });
   await expect(onboardingCta).toHaveAttribute("href", "/overview?onboarding=EU");
+  await onboardingCta.click();
+
+  await expect(page).toHaveURL(/\/overview\?onboarding=EU$/);
+  await expect(page.getByRole("dialog").getByText("KYC is currently disabled in Europe.")).toBeVisible();
 
   expect(backend.unmatchedRequests).toEqual([]);
   expect(backend.unexpectedExternalRequests).toEqual([]);
diff --git a/apps/dashboard/e2e/support/mockBackend.ts b/apps/dashboard/e2e/support/mockBackend.ts
index 593a4e092..43cc0dd9c 100644
--- a/apps/dashboard/e2e/support/mockBackend.ts
+++ b/apps/dashboard/e2e/support/mockBackend.ts
@@ -256,6 +256,7 @@ interface MockBackendOptions {
   selectionRequired?: boolean;
   // Full response for POST /v1/auth/verify-otp. Default: a successful session.
   verifyOtp?: (requestBody: Record<string, unknown>) => { status: number; body: unknown };
+  verifyTokenValid?: boolean;
   // How many GET /v1/ramp/:id polls report an in-progress ramp before flipping to COMPLETE.
   pendingStatusPolls?: number;
   // Drives the Alfredpay MX KYC endpoints and, unless reflectOnboarding is false, makes
@@ -475,6 +476,10 @@ export async function mockBackend(page: Page, options: MockBackendOptions = {})
       await fulfillJson(result.body, result.status);
       return;
     }
+    if (path === "/v1/auth/verify" && method === "POST") {
+      await fulfillJson({ user_id: E2E_USER_ID, valid: options.verifyTokenValid !== false });
+      return;
+    }
     if (path === "/v1/auth/refresh" && method === "POST") {
       auth.refreshes += 1;
       await fulfillJson({ access_token: "e2e-access-token", refresh_token: "e2e-refresh-token", success: true });
diff --git a/apps/dashboard/e2e/support/session.ts b/apps/dashboard/e2e/support/session.ts
index c77497af7..aa7946e16 100644
--- a/apps/dashboard/e2e/support/session.ts
+++ b/apps/dashboard/e2e/support/session.ts
@@ -14,18 +14,17 @@ export const SESSION_KEYS = {
 } as const;
 
 /**
- * Boots the app already authenticated: useAuthStore reads the session from localStorage at
- * module init, so it has to be there before any app script runs. The access token is not a
- * JWT on purpose — AuthService.isAuthenticated() treats an undecodable expiry as valid.
+ * Boots the app with a stored session before any app script runs. The default access token is
+ * not a JWT on purpose so tests can opt into specific expiry behavior when needed.
  */
-export async function seedSession(page: Page) {
+export async function seedSession(page: Page, accessToken = "e2e-access-token") {
   await page.addInitScript(
-    ({ email, keys, userId }) => {
-      localStorage.setItem(keys.accessToken, "e2e-access-token");
+    ({ accessToken: token, email, keys, userId }) => {
+      localStorage.setItem(keys.accessToken, token);
       localStorage.setItem(keys.refreshToken, "e2e-refresh-token");
       localStorage.setItem(keys.userId, userId);
       localStorage.setItem(keys.userEmail, email);
     },
-    { email: E2E_USER_EMAIL, keys: SESSION_KEYS, userId: E2E_USER_ID }
+    { accessToken, email: E2E_USER_EMAIL, keys: SESSION_KEYS, userId: E2E_USER_ID }
   );
 }
diff --git a/apps/dashboard/e2e/transactions.spec.ts b/apps/dashboard/e2e/transactions.spec.ts
index c0a70650b..096eac1ba 100644
--- a/apps/dashboard/e2e/transactions.spec.ts
+++ b/apps/dashboard/e2e/transactions.spec.ts
@@ -38,16 +38,16 @@ test("transaction destinations and failure help are direction-aware", async ({ p
   await seedSession(page);
   await page.goto("/transactions");
 
-  const onrampRow = page.getByRole("row").filter({ hasText: "Onramp" });
+  const onrampRow = page.getByRole("row").filter({ hasText: "Pay-in" });
   await expect(onrampRow).toContainText("0x1111…1111");
   await onrampRow.getByRole("button", { name: "Get help" }).click();
-  await expect(page.getByText("We'll email you about this failed onramp.", { exact: true })).toBeVisible();
+  await expect(page.getByText("We'll email you about this failed pay-in.", { exact: true })).toBeVisible();
 
-  const offrampRow = page.getByRole("row").filter({ hasText: "Offramp" });
-  await expect(offrampRow).toContainText("Payout account");
+  const offrampRow = page.getByRole("row").filter({ hasText: "Pay-out" });
+  await expect(offrampRow).toContainText("Pay-out account");
   await expect(offrampRow).not.toContainText("0x2222…2222");
   await offrampRow.getByRole("button", { name: "Get help" }).click();
-  await expect(page.getByText("We'll email you about this failed payout.", { exact: true })).toBeVisible();
+  await expect(page.getByText("We'll email you about this failed pay-out.", { exact: true })).toBeVisible();
 
   expect(backend.unmatchedRequests).toEqual([]);
   expect(backend.unexpectedExternalRequests).toEqual([]);
diff --git a/apps/dashboard/src/components/onboarding/PayoutAccountsSection.tsx b/apps/dashboard/src/components/onboarding/PayoutAccountsSection.tsx
index 61d1a1d45..fcae75734 100644
--- a/apps/dashboard/src/components/onboarding/PayoutAccountsSection.tsx
+++ b/apps/dashboard/src/components/onboarding/PayoutAccountsSection.tsx
@@ -23,19 +23,19 @@ export function PayoutAccountsSection({ accounts, corridorId, error, isLoading,
   }
 
   if (isLoading) {
-    return <p className="w-full text-center text-muted-foreground text-sm">Loading payout accounts…</p>;
+    return <p className="w-full text-center text-muted-foreground text-sm">Loading pay-out accounts…</p>;
   }
   if (isApiError(error) && error.status === 404) {
     return (
       <p className="w-full text-center text-muted-foreground text-sm">
-        Payout setup not available yet — finish verification first.
+        Pay-out setup not available yet — finish verification first.
       </p>
     );
   }
   if (error) {
     return (
       <div className="grid w-full gap-2 text-center">
-        <p className="text-muted-foreground text-sm">Couldn't load payout accounts.</p>
+        <p className="text-muted-foreground text-sm">Couldn't load pay-out accounts.</p>
         <Button onClick={refetch} size="sm" type="button" variant="outline">
           Retry
         </Button>
@@ -49,16 +49,16 @@ export function PayoutAccountsSection({ accounts, corridorId, error, isLoading,
       {savedAccounts.length === 0 ? (
         <>
           <p className="text-muted-foreground text-xs">
-            Add a payout account to enable reception of money through offramps. Onramps and third-party payments work without
+            Add a pay-out account to enable reception of money through pay-outs. Pay-ins and third-party payments work without
             one.
           </p>
           <Button onClick={() => show("form")} type="button">
-            Add payout account
+            Add pay-out account
           </Button>
         </>
       ) : (
         <Button onClick={() => show("list")} type="button" variant="outline">
-          View payout accounts
+          View pay-out accounts
         </Button>
       )}
       <FiatAccountDialog
diff --git a/apps/dashboard/src/components/onboarding/alfredpay/FiatAccountDialog.tsx b/apps/dashboard/src/components/onboarding/alfredpay/FiatAccountDialog.tsx
index 164489afe..fe2764296 100644
--- a/apps/dashboard/src/components/onboarding/alfredpay/FiatAccountDialog.tsx
+++ b/apps/dashboard/src/components/onboarding/alfredpay/FiatAccountDialog.tsx
@@ -59,9 +59,9 @@ export function FiatAccountDialog({ accounts, corridorId, onOpenChange, onViewCh
     try {
       await deleteFiatAccount.mutateAsync(fiatAccountId);
       setConfirmingDeleteId(null);
-      toast.success("Payout account removed");
+      toast.success("Pay-out account removed");
     } catch (error) {
-      toast.error("Could not remove payout account", { description: error instanceof Error ? error.message : undefined });
+      toast.error("Could not remove pay-out account", { description: error instanceof Error ? error.message : undefined });
     }
   }
 
@@ -70,7 +70,7 @@ export function FiatAccountDialog({ accounts, corridorId, onOpenChange, onViewCh
       await addFiatAccount.mutateAsync(toAddFiatAccountRequest(corridorId, values));
       form.reset(fiatAccountDefaultValues(corridorId));
       onViewChange("list");
-      toast.success("Payout account added");
+      toast.success("Pay-out account added");
     } catch (error) {
       if (isApiError(error)) {
         for (const fieldError of error.data.fields ?? []) {
@@ -78,9 +78,9 @@ export function FiatAccountDialog({ accounts, corridorId, onOpenChange, onViewCh
             form.setError(fieldError.field, { message: fieldError.message });
           }
         }
-        form.setError("root.server", { message: error.message || "Could not add payout account" });
+        form.setError("root.server", { message: error.message || "Could not add pay-out account" });
       } else {
-        form.setError("root.server", { message: "Could not add payout account" });
+        form.setError("root.server", { message: "Could not add pay-out account" });
       }
     }
   }
@@ -91,9 +91,9 @@ export function FiatAccountDialog({ accounts, corridorId, onOpenChange, onViewCh
         {view === "list" ? (
           <>
             <DialogHeader>
-              <DialogTitle>Payout accounts</DialogTitle>
+              <DialogTitle>Pay-out accounts</DialogTitle>
               <DialogDescription>
-                Accounts available for receiving money through {config.methodLabel}. Payout accounts are not needed for onramps
+                Accounts available for receiving money through {config.methodLabel}. Payout accounts are not needed for pay-ins
                 or payments to third-party recipients.
               </DialogDescription>
             </DialogHeader>
@@ -105,7 +105,7 @@ export function FiatAccountDialog({ accounts, corridorId, onOpenChange, onViewCh
                   </span>
                   <div className="min-w-0 flex-1">
                     <p className="truncate font-medium text-sm">
-                      {account.metadata?.accountHolderName || account.accountName || "Payout account"} · ••••
+                      {account.metadata?.accountHolderName || account.accountName || "Pay-out account"} · ••••
                       {account.accountNumber.slice(-4)}
                     </p>
                     <p className="text-muted-foreground text-xs">{config.methodLabel}</p>
@@ -138,9 +138,9 @@ export function FiatAccountDialog({ accounts, corridorId, onOpenChange, onViewCh
         ) : (
           <>
             <DialogHeader>
-              <DialogTitle>Add payout account</DialogTitle>
+              <DialogTitle>Add pay-out account</DialogTitle>
               <DialogDescription>
-                This account enables reception of money through offramps. Onramps and payments to third-party recipients work
+                This account enables reception of money through pay-outs. Pay-ins and payments to third-party recipients work
                 without one.
               </DialogDescription>
             </DialogHeader>
@@ -204,7 +204,7 @@ export function FiatAccountDialog({ accounts, corridorId, onOpenChange, onViewCh
                     </Button>
                   )}
                   <Button disabled={addFiatAccount.isPending} type="submit">
-                    {addFiatAccount.isPending ? "Saving…" : "Save payout account"}
+                    {addFiatAccount.isPending ? "Saving…" : "Save pay-out account"}
                   </Button>
                 </DialogFooter>
               </form>
diff --git a/apps/dashboard/src/components/quote/QuoteExplorer.tsx b/apps/dashboard/src/components/quote/QuoteExplorer.tsx
index a219dcbc5..16bbc2187 100644
--- a/apps/dashboard/src/components/quote/QuoteExplorer.tsx
+++ b/apps/dashboard/src/components/quote/QuoteExplorer.tsx
@@ -305,7 +305,7 @@ function QuoteCta({ amount, corridorId, isApproved, isBuy, network, token }: Quo
       <Button asChild size="lg">
         <Link search={{ onboarding: corridorId }} to="/overview">
           <ShieldCheck />
-          Get approved for {CORRIDORS[corridorId].name}
+          Start onboarding for {CORRIDORS[corridorId].name}
           <ArrowRight />
         </Link>
       </Button>
diff --git a/apps/dashboard/src/components/recipients/RecipientDialog.tsx b/apps/dashboard/src/components/recipients/RecipientDialog.tsx
index d7078d14d..464f47a10 100644
--- a/apps/dashboard/src/components/recipients/RecipientDialog.tsx
+++ b/apps/dashboard/src/components/recipients/RecipientDialog.tsx
@@ -155,7 +155,7 @@ export function RecipientDialog({
               <DialogTitle>Add a recipient</DialogTitle>
               <DialogDescription>
                 Choose who you're paying and name the link. We'll generate an invite link you send them yourself — they complete
-                KYC/KYB and add their payout details to receive transfers.
+                KYC/KYB and add their pay-out details to receive transfers.
               </DialogDescription>
             </DialogHeader>
             <Form {...form}>
@@ -289,7 +289,7 @@ function InviteShare({ created, onDone }: { created: CreatedInvite; onDone: () =
       <DialogHeader>
         <DialogTitle>Invite link ready</DialogTitle>
         <DialogDescription>
-          Send this {created.corridorName} link to your recipient. They'll complete KYC/KYB and add their payout details — then
+          Send this {created.corridorName} link to your recipient. They'll complete KYC/KYB and add their pay-out details — then
           you can pay them.
         </DialogDescription>
       </DialogHeader>
diff --git a/apps/dashboard/src/components/recipients/RecipientsTable.tsx b/apps/dashboard/src/components/recipients/RecipientsTable.tsx
index ffcdffeb7..0084d189a 100644
--- a/apps/dashboard/src/components/recipients/RecipientsTable.tsx
+++ b/apps/dashboard/src/components/recipients/RecipientsTable.tsx
@@ -27,7 +27,7 @@ export function RecipientsTable({ recipients }: { recipients: Recipient[] }) {
           <TableRow>
             <TableHead>Recipient</TableHead>
             <TableHead>Country</TableHead>
-            <TableHead>Payout</TableHead>
+            <TableHead>Pay-out</TableHead>
             <TableHead>Status</TableHead>
             <TableHead className="text-right">Action</TableHead>
           </TableRow>
diff --git a/apps/dashboard/src/components/transactions/TransactionsTable.tsx b/apps/dashboard/src/components/transactions/TransactionsTable.tsx
index cdcb986a6..fe6979e6b 100644
--- a/apps/dashboard/src/components/transactions/TransactionsTable.tsx
+++ b/apps/dashboard/src/components/transactions/TransactionsTable.tsx
@@ -74,7 +74,7 @@ export function TransactionsTable({
                   month: "short"
                 })}
               </TableCell>
-              <TableCell className="font-medium">{tx.direction === "BUY" ? "Onramp" : "Offramp"}</TableCell>
+              <TableCell className="font-medium">{tx.direction === "BUY" ? "Pay-in" : "Pay-out"}</TableCell>
               <TableCell>
                 <div className="grid gap-0.5">
                   <code className="font-mono text-xs">
@@ -127,7 +127,7 @@ export function TransactionsTable({
 }
 
 function FailedAction({ direction, reason }: { direction: Transaction["direction"]; reason?: string }) {
-  const transferLabel = direction === "BUY" ? "onramp" : "payout";
+  const transferLabel = direction === "BUY" ? "pay-in" : "pay-out";
   return (
     <Tooltip>
       <TooltipTrigger asChild>
diff --git a/apps/dashboard/src/components/transfer/OnrampForm.tsx b/apps/dashboard/src/components/transfer/OnrampForm.tsx
index 810640539..f5f11e3fb 100644
--- a/apps/dashboard/src/components/transfer/OnrampForm.tsx
+++ b/apps/dashboard/src/components/transfer/OnrampForm.tsx
@@ -128,7 +128,7 @@ export function OnrampForm({ account, prefill }: { account: SenderAccount; prefi
         <TriangleAlert className="mt-px size-4 shrink-0 text-warning" />
         <div className="grid gap-1">
           <p className="font-medium">Another account has an unfinished transfer</p>
-          <p className="text-muted-foreground">Switch back to that account to resume it before starting a new onramp.</p>
+          <p className="text-muted-foreground">Switch back to that account to resume it before starting a new pay-in.</p>
         </div>
       </div>
     );
@@ -163,7 +163,7 @@ export function OnrampForm({ account, prefill }: { account: SenderAccount; prefi
     return (
       <div className="flex items-start gap-3 rounded-lg border border-dashed p-4 text-sm">
         <Lock className="mt-px size-4 shrink-0 text-muted-foreground" />
-        <p className="text-muted-foreground">Complete onboarding for a supported corridor before starting an onramp.</p>
+        <p className="text-muted-foreground">Complete onboarding for a supported corridor before starting a pay-in.</p>
       </div>
     );
   }
@@ -283,7 +283,7 @@ export function OnrampForm({ account, prefill }: { account: SenderAccount; prefi
         {error ? (
           <div className="flex items-start gap-2 rounded-lg border border-destructive/40 bg-destructive/5 p-3 text-destructive text-sm">
             <TriangleAlert className="mt-px size-4 shrink-0" />
-            <p>We couldn’t fetch an onramp quote right now. Try another amount or token.</p>
+            <p>We couldn’t fetch a pay-in quote right now. Try another amount or token.</p>
           </div>
         ) : Number(amount) <= 0 ? (
           <p className="rounded-lg border border-dashed p-4 text-center text-muted-foreground text-sm">
diff --git a/apps/dashboard/src/components/transfer/OnrampPaymentInstructions.tsx b/apps/dashboard/src/components/transfer/OnrampPaymentInstructions.tsx
index 006aa0bdd..fe4014e70 100644
--- a/apps/dashboard/src/components/transfer/OnrampPaymentInstructions.tsx
+++ b/apps/dashboard/src/components/transfer/OnrampPaymentInstructions.tsx
@@ -100,12 +100,12 @@ export function OnrampPaymentInstructions({ ramp }: { ramp: RampProcess }) {
     const subscription = transferActor.subscribe(snapshot => {
       if (snapshot.matches("Tracking")) {
         subscription.unsubscribe();
-        toast.success("Onramp initiated", { description: "We’ll update your transaction as the payment settles." });
+        toast.success("Pay-in initiated", { description: "We’ll update your transaction as the payment settles." });
         navigate({ to: "/transactions" });
       } else if (snapshot.matches("AwaitingPayment") || snapshot.matches("Failed")) {
         // A failed start returns to AwaitingPayment so the ramp and instructions survive.
         subscription.unsubscribe();
-        toast.error("Could not start onramp", { description: snapshot.context.errorMessage ?? undefined });
+        toast.error("Could not start pay-in", { description: snapshot.context.errorMessage ?? undefined });
       }
     });
     transferActor.send({ type: "PAYMENT_CONFIRMED" });
diff --git a/apps/dashboard/src/components/transfer/TransferForm.tsx b/apps/dashboard/src/components/transfer/TransferForm.tsx
index 31e9a9490..edc9125f7 100644
--- a/apps/dashboard/src/components/transfer/TransferForm.tsx
+++ b/apps/dashboard/src/components/transfer/TransferForm.tsx
@@ -196,7 +196,7 @@ export function TransferForm({ account, prefill, recipients, preselectRecipientI
             })}
           </SelectContent>
         </Select>
-        <p className="text-muted-foreground text-xs">Choose one of your approved payout accounts.</p>
+        <p className="text-muted-foreground text-xs">Choose one of your approved pay-out accounts.</p>
       </div>
 
       {selected && !isSendable && (
@@ -229,7 +229,7 @@ export function TransferForm({ account, prefill, recipients, preselectRecipientI
             <Row label="Country">
               {corridor.flag} {corridor.name}
             </Row>
-            <Row label="Payout method">
+            <Row label="Pay-out method">
               {PAYMENT_METHOD_LABEL[selected.bankDetails.method]} · {selected.bankDetails.value}
             </Row>
           </div>
@@ -251,7 +251,7 @@ export function TransferForm({ account, prefill, recipients, preselectRecipientI
 
           <div className="grid grid-cols-2 gap-3">
             <div className="grid gap-2">
-              <Label>Payin network</Label>
+              <Label>Network</Label>
               <Select onValueChange={setRequestedNetwork} value={activeNetwork?.id}>
                 <SelectTrigger className="w-full">
                   <SelectValue />
diff --git a/apps/dashboard/src/domain/types.ts b/apps/dashboard/src/domain/types.ts
index 1728d877b..3c562442b 100644
--- a/apps/dashboard/src/domain/types.ts
+++ b/apps/dashboard/src/domain/types.ts
@@ -76,7 +76,7 @@ export interface Transaction {
   direction: "BUY" | "SELL";
   accountId: string;
   recipientId: string;
-  /** Denormalized display label; for ramp-history rows a destination label ("Payout account", "Your wallet"). */
+  /** Denormalized display label; for ramp-history rows a destination label ("Pay-out account", "Your wallet"). */
   recipientEmail: string;
   corridorId: CorridorId;
   /** SELL: the sender's funding wallet. BUY: the wallet tokens are delivered to. */
diff --git a/apps/dashboard/src/hooks/useTokenRefresh.ts b/apps/dashboard/src/hooks/useTokenRefresh.ts
new file mode 100644
index 000000000..68db765a9
--- /dev/null
+++ b/apps/dashboard/src/hooks/useTokenRefresh.ts
@@ -0,0 +1,19 @@
+import { useEffect } from "react";
+import { AuthService } from "@/services/auth";
+import { startTokenRefresh } from "@/services/tokenRefresh";
+import { useAuthStore } from "@/stores/auth.store";
+
+export function useTokenRefresh(): void {
+  const user = useAuthStore(state => state.user);
+  const logout = useAuthStore(state => state.logout);
+
+  useEffect(() => {
+    if (!user) return;
+
+    return startTokenRefresh({
+      getExpiryMs: () => AuthService.getAccessTokenExpiryMs(),
+      onInvalid: logout,
+      refresh: () => AuthService.refreshAccessToken()
+    });
+  }, [logout, user]);
+}
diff --git a/apps/dashboard/src/machines/transferActor.ts b/apps/dashboard/src/machines/transferActor.ts
index 24517a805..8b3d5f52e 100644
--- a/apps/dashboard/src/machines/transferActor.ts
+++ b/apps/dashboard/src/machines/transferActor.ts
@@ -62,7 +62,7 @@ transferActor.on("STATUS_CHANGED", event => {
   if (event.status.currentPhase === "complete" && !notifiedRampIds.has(event.ramp.id)) {
     notifiedRampIds.add(event.ramp.id);
     const meta = transferActor.getSnapshot().context.meta;
-    const label = meta?.direction === RampDirection.BUY ? "Onramp" : "Payout";
+    const label = meta?.direction === RampDirection.BUY ? "Pay-in" : "Pay-out";
     notifyTransferCompleted(meta ? `${label} of ${meta.summary}` : "Transfer completed");
   }
 });
diff --git a/apps/dashboard/src/main.tsx b/apps/dashboard/src/main.tsx
index 91b1afe3f..9d96faec5 100644
--- a/apps/dashboard/src/main.tsx
+++ b/apps/dashboard/src/main.tsx
@@ -7,6 +7,7 @@ import "@/App.css";
 import { queryClient } from "@/lib/queryClient";
 import { wagmiConfig } from "@/lib/wagmi";
 import { getRouter } from "@/router";
+import { useAuthStore } from "@/stores/auth.store";
 
 const router = getRouter();
 
@@ -18,10 +19,16 @@ if (!root) {
   throw new Error("Root element not found");
 }
 
-createRoot(root).render(
-  <WagmiProvider config={wagmiConfig}>
-    <QueryClientProvider client={queryClient}>
-      <RouterProvider router={router} />
-    </QueryClientProvider>
-  </WagmiProvider>
-);
+async function renderApp(container: HTMLElement) {
+  await useAuthStore.getState().restoreSession();
+
+  createRoot(container).render(
+    <WagmiProvider config={wagmiConfig}>
+      <QueryClientProvider client={queryClient}>
+        <RouterProvider router={router} />
+      </QueryClientProvider>
+    </WagmiProvider>
+  );
+}
+
+void renderApp(root);
diff --git a/apps/dashboard/src/routes/__root.tsx b/apps/dashboard/src/routes/__root.tsx
index ebfa0d7d3..f5d0edf70 100644
--- a/apps/dashboard/src/routes/__root.tsx
+++ b/apps/dashboard/src/routes/__root.tsx
@@ -1,12 +1,15 @@
 import { createRootRoute, Outlet } from "@tanstack/react-router";
 import { MotionConfig } from "motion/react";
 import { Toaster } from "@/components/ui/sonner";
+import { useTokenRefresh } from "@/hooks/useTokenRefresh";
 
 export const Route = createRootRoute({
   component: RootComponent
 });
 
 function RootComponent() {
+  useTokenRefresh();
+
   return (
     <MotionConfig reducedMotion="user">
       <Outlet />
diff --git a/apps/dashboard/src/routes/_app/recipients.tsx b/apps/dashboard/src/routes/_app/recipients.tsx
index 26fa85283..810c600ce 100644
--- a/apps/dashboard/src/routes/_app/recipients.tsx
+++ b/apps/dashboard/src/routes/_app/recipients.tsx
@@ -82,7 +82,7 @@ function RecipientsPage() {
               <div className="grid gap-1">
                 <p className="font-medium">No recipients yet</p>
                 <p className="text-pretty text-muted-foreground text-sm">
-                  Add a recipient and share their invite link — they complete KYC/KYB and add payout details to receive
+                  Add a recipient and share their invite link — they complete KYC/KYB and add pay-out details to receive
                   transfers.
                 </p>
               </div>
diff --git a/apps/dashboard/src/routes/_app/settings.tsx b/apps/dashboard/src/routes/_app/settings.tsx
index cc48b6e90..6d61dd0fd 100644
--- a/apps/dashboard/src/routes/_app/settings.tsx
+++ b/apps/dashboard/src/routes/_app/settings.tsx
@@ -24,7 +24,7 @@ const NOTIFICATION_PREFS = [
   },
   {
     defaultChecked: true,
-    description: "When a wallet-to-fiat payout settles or fails.",
+    description: "When a wallet-to-fiat pay-out settles or fails.",
     id: "transfers",
     label: "Transfer status"
   }
diff --git a/apps/dashboard/src/routes/_app/transactions.tsx b/apps/dashboard/src/routes/_app/transactions.tsx
index 2687127f2..527103de2 100644
--- a/apps/dashboard/src/routes/_app/transactions.tsx
+++ b/apps/dashboard/src/routes/_app/transactions.tsx
@@ -35,7 +35,7 @@ function TransactionsPage() {
     <Stagger className="mx-auto grid max-w-5xl gap-6">
       <StaggerItem>
         <h1 className="text-balance font-semibold text-2xl tracking-tight">Transactions</h1>
-        <p className="text-muted-foreground">Onramp and offramp history for {account.name}.</p>
+        <p className="text-muted-foreground">Pay-in and pay-out history for {account.name}.</p>
       </StaggerItem>
 
       {resumableRamp && (
@@ -75,8 +75,8 @@ function TransactionsPage() {
                 <p className="font-medium">No transactions yet</p>
                 <p className="text-pretty text-muted-foreground text-sm">
                   {hasApprovedRecipient
-                    ? "Start an onramp or pay an approved payout account and it will appear here."
-                    : "Start an onramp or approve a payout account to create your first transaction."}
+                    ? "Start a pay-in or pay an approved pay-out account and it will appear here."
+                    : "Start a pay-in or approve a pay-out account to create your first transaction."}
                 </p>
               </div>
               {hasApprovedRecipient ? (
@@ -90,12 +90,12 @@ function TransactionsPage() {
                 <div className="flex flex-wrap justify-center gap-2">
                   <Button asChild>
                     <Link search={{ mode: "onramp" }} to="/transfer">
-                      Start an onramp
+                      Start a pay-in
                       <ArrowRight />
                     </Link>
                   </Button>
                   <Button asChild variant="outline">
-                    <Link to="/overview">Set up a payout account</Link>
+                    <Link to="/overview">Set up a pay-out account</Link>
                   </Button>
                 </div>
               )}
diff --git a/apps/dashboard/src/routes/_app/transfer.tsx b/apps/dashboard/src/routes/_app/transfer.tsx
index e8c88f63b..776b55ff2 100644
--- a/apps/dashboard/src/routes/_app/transfer.tsx
+++ b/apps/dashboard/src/routes/_app/transfer.tsx
@@ -59,10 +59,10 @@ function TransferPage() {
         <h1 className="text-balance font-semibold text-2xl tracking-tight">New transfer</h1>
         <p className="text-pretty text-muted-foreground">
           {mode === "offramp"
-            ? "Convert supported EVM tokens into fiat through an approved payout account."
+            ? "Convert supported EVM tokens into fiat through an approved pay-out account."
             : mode === "onramp"
               ? "Pay with fiat and receive tokens in an EVM wallet."
-              : "Send money directly across borders."}
+              : "Send fiat directly from one currency to another."}
         </p>
       </StaggerItem>
 
@@ -76,9 +76,9 @@ function TransferPage() {
           value={mode}
         >
           <TabsList className="grid h-11 w-full grid-cols-3">
-            <TabsTrigger value="offramp">Offramp</TabsTrigger>
-            <TabsTrigger value="onramp">Onramp</TabsTrigger>
-            <TabsTrigger value="cross-border">Cross-border</TabsTrigger>
+            <TabsTrigger value="onramp">Pay-in</TabsTrigger>
+            <TabsTrigger value="offramp">Pay-out</TabsTrigger>
+            <TabsTrigger value="cross-border">Fiat-to-Fiat</TabsTrigger>
           </TabsList>
         </Tabs>
       </StaggerItem>
@@ -87,7 +87,7 @@ function TransferPage() {
         <StaggerItem>
           <Card>
             <CardHeader>
-              <CardTitle>Onramp details</CardTitle>
+              <CardTitle>Pay-in details</CardTitle>
             </CardHeader>
             <CardContent>
               <OnrampForm account={account} prefill={{ amount, corridorId, network, token }} />
@@ -102,7 +102,7 @@ function TransferPage() {
                 <Globe2 className="size-5" />
               </span>
               <div className="grid gap-1">
-                <p className="font-medium">Cross-border transfers are coming soon</p>
+                <p className="font-medium">Fiat-to-Fiat transfers are coming soon</p>
                 <p className="max-w-sm text-pretty text-muted-foreground text-sm">
                   You’ll be able to pay approved recipients directly across supported countries from here.
                 </p>
diff --git a/apps/dashboard/src/routes/monerium.callback.tsx b/apps/dashboard/src/routes/monerium.callback.tsx
index 591675c76..fc90e29f2 100644
--- a/apps/dashboard/src/routes/monerium.callback.tsx
+++ b/apps/dashboard/src/routes/monerium.callback.tsx
@@ -57,7 +57,7 @@ function MoneriumCallbackPage() {
   useEffect(() => {
     if (DASHBOARD_STATES.has(value)) {
       queryClient.invalidateQueries({ queryKey: ONBOARDING_STATUS_QUERY_KEY });
-      restoreSession();
+      void restoreSession();
       navigate({ replace: true, search: { onboarding: "EU" }, to: "/overview" });
     }
   }, [navigate, restoreSession, value]);
diff --git a/apps/dashboard/src/services/api/auth.api.ts b/apps/dashboard/src/services/api/auth.api.ts
index 42ee2a5bf..ec3a216d7 100644
--- a/apps/dashboard/src/services/api/auth.api.ts
+++ b/apps/dashboard/src/services/api/auth.api.ts
@@ -24,4 +24,11 @@ export class AuthAPI {
       userId: data.user_id
     };
   }
+
+  static async verifyToken(accessToken: string): Promise<{ valid: boolean; userId?: string }> {
+    const data = await apiClient.post<{ valid: boolean; user_id?: string }>("/auth/verify", {
+      access_token: accessToken
+    });
+    return { userId: data.user_id, valid: data.valid };
+  }
 }
diff --git a/apps/dashboard/src/services/api/transaction.mappers.test.ts b/apps/dashboard/src/services/api/transaction.mappers.test.ts
index 630336caa..73db04f69 100644
--- a/apps/dashboard/src/services/api/transaction.mappers.test.ts
+++ b/apps/dashboard/src/services/api/transaction.mappers.test.ts
@@ -126,6 +126,6 @@ describe("mapRampHistoryTransaction", () => {
 
     assert.equal(transaction?.direction, RampDirection.SELL);
     assert.equal(transaction?.payinWallet, "0x2222222222222222222222222222222222222222");
-    assert.equal(transaction?.recipientEmail, "Payout account");
+    assert.equal(transaction?.recipientEmail, "Pay-out account");
   });
 });
diff --git a/apps/dashboard/src/services/api/transaction.mappers.ts b/apps/dashboard/src/services/api/transaction.mappers.ts
index d4fd348f7..717980ca1 100644
--- a/apps/dashboard/src/services/api/transaction.mappers.ts
+++ b/apps/dashboard/src/services/api/transaction.mappers.ts
@@ -46,7 +46,7 @@ export function mapRampHistoryTransaction(tx: GetRampHistoryTransaction, account
     payinNetwork: String(isOnramp ? tx.to : tx.from),
     payinWallet: tx.walletAddress ?? "",
     payoutCurrency: String(tx.toCurrency),
-    recipientEmail: isOnramp ? "Your wallet" : "Payout account",
+    recipientEmail: isOnramp ? "Your wallet" : "Pay-out account",
     recipientId: "",
     status: mapTransactionStatus(tx)
   };
diff --git a/apps/dashboard/src/services/auth.ts b/apps/dashboard/src/services/auth.ts
index 6e2cb9487..4de455dc1 100644
--- a/apps/dashboard/src/services/auth.ts
+++ b/apps/dashboard/src/services/auth.ts
@@ -54,6 +54,11 @@ export class AuthService {
     return expiryMs === null || expiryMs > Date.now();
   }
 
+  static getAccessTokenExpiryMs(): number | null {
+    const tokens = this.getTokens();
+    return tokens ? this.decodeJwtExpiryMs(tokens.accessToken) : null;
+  }
+
   private static decodeJwtExpiryMs(token: string): number | null {
     try {
       const payload = token.split(".")[1];
diff --git a/apps/dashboard/src/services/sessionRestore.test.ts b/apps/dashboard/src/services/sessionRestore.test.ts
new file mode 100644
index 000000000..c402dd12d
--- /dev/null
+++ b/apps/dashboard/src/services/sessionRestore.test.ts
@@ -0,0 +1,63 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type { AuthTokens } from "./auth";
+import { restoreAuthSession } from "./sessionRestore";
+
+const TOKENS: AuthTokens = {
+  accessToken: "access",
+  refreshToken: "refresh",
+  userEmail: "user@example.com",
+  userId: "stored-user"
+};
+
+describe("restoreAuthSession", () => {
+  it("keeps a verified access-token session without refreshing", async () => {
+    let refreshes = 0;
+    const restored = await restoreAuthSession({
+      refresh: async () => {
+        refreshes += 1;
+        return null;
+      },
+      tokens: TOKENS,
+      verify: async () => ({ userId: "verified-user", valid: true })
+    });
+
+    assert.deepEqual(restored, { ...TOKENS, userId: "verified-user" });
+    assert.equal(refreshes, 0);
+  });
+
+  it("refreshes an invalid access-token session", async () => {
+    const refreshed = { ...TOKENS, accessToken: "rotated-access", refreshToken: "rotated-refresh" };
+    const restored = await restoreAuthSession({
+      refresh: async () => refreshed,
+      tokens: TOKENS,
+      verify: async () => ({ valid: false })
+    });
+
+    assert.deepEqual(restored, refreshed);
+  });
+
+  it("ends a session when its refresh token is confirmed invalid", async () => {
+    const restored = await restoreAuthSession({
+      refresh: async () => null,
+      tokens: TOKENS,
+      verify: async () => ({ valid: false })
+    });
+
+    assert.equal(restored, null);
+  });
+
+  it("preserves stored tokens when refresh fails transiently", async () => {
+    const restored = await restoreAuthSession({
+      refresh: async () => {
+        throw new Error("network unavailable");
+      },
+      tokens: TOKENS,
+      verify: async () => {
+        throw new Error("verification unavailable");
+      }
+    });
+
+    assert.equal(restored, TOKENS);
+  });
+});
diff --git a/apps/dashboard/src/services/sessionRestore.ts b/apps/dashboard/src/services/sessionRestore.ts
new file mode 100644
index 000000000..1d2c90aa2
--- /dev/null
+++ b/apps/dashboard/src/services/sessionRestore.ts
@@ -0,0 +1,27 @@
+import type { AuthTokens } from "./auth";
+
+interface SessionRestoreOptions {
+  refresh: () => Promise<AuthTokens | null>;
+  tokens: AuthTokens | null;
+  verify: (accessToken: string) => Promise<{ valid: boolean; userId?: string }>;
+}
+
+export async function restoreAuthSession({ refresh, tokens, verify }: SessionRestoreOptions): Promise<AuthTokens | null> {
+  if (!tokens) return null;
+
+  try {
+    const result = await verify(tokens.accessToken);
+    if (result.valid && result.userId) {
+      return { ...tokens, userId: result.userId };
+    }
+  } catch {
+    // Verification failure may be an expired token or a transient request failure; try refresh.
+  }
+
+  try {
+    return await refresh();
+  } catch {
+    // Preserve the session on transient failures so request-level recovery can retry later.
+    return tokens;
+  }
+}
diff --git a/apps/dashboard/src/services/tokenRefresh.test.ts b/apps/dashboard/src/services/tokenRefresh.test.ts
new file mode 100644
index 000000000..fb1afa6f8
--- /dev/null
+++ b/apps/dashboard/src/services/tokenRefresh.test.ts
@@ -0,0 +1,84 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import type { AuthTokens } from "@/services/auth";
+import { startTokenRefresh } from "@/services/tokenRefresh";
+
+const TOKENS: AuthTokens = {
+  accessToken: "access",
+  refreshToken: "refresh",
+  userId: "user"
+};
+
+function createTimers() {
+  const pending: Array<{ callback: () => void | Promise<void>; delay: number }> = [];
+
+  return {
+    pending,
+    setTimer: (callback: () => void | Promise<void>, delay: number) => {
+      const timer = { callback, delay };
+      pending.push(timer);
+      return timer as unknown as ReturnType<typeof setTimeout>;
+    }
+  };
+}
+
+describe("startTokenRefresh", () => {
+  it("refreshes before expiry and reschedules from the rotated token", async () => {
+    const timers = createTimers();
+    let expiryMs = 121_000;
+    let refreshes = 0;
+
+    startTokenRefresh({
+      getExpiryMs: () => expiryMs,
+      now: () => 1_000,
+      onInvalid: () => assert.fail("session should remain valid"),
+      refresh: async () => {
+        refreshes += 1;
+        expiryMs = 241_000;
+        return TOKENS;
+      },
+      setTimer: timers.setTimer
+    });
+
+    assert.equal(timers.pending[0]?.delay, 60_000);
+    await timers.pending.shift()?.callback();
+    assert.equal(refreshes, 1);
+    assert.equal(timers.pending[0]?.delay, 180_000);
+  });
+
+  it("retries transient refresh failures after 30 seconds", async () => {
+    const timers = createTimers();
+
+    startTokenRefresh({
+      getExpiryMs: () => 60_000,
+      now: () => 0,
+      onInvalid: () => assert.fail("transient failures must not log out"),
+      refresh: async () => {
+        throw new Error("network unavailable");
+      },
+      setTimer: timers.setTimer
+    });
+
+    await timers.pending.shift()?.callback();
+    assert.equal(timers.pending[0]?.delay, 30_000);
+  });
+
+  it("logs out when the refresh token is confirmed invalid", async () => {
+    const timers = createTimers();
+    let invalidated = false;
+
+    startTokenRefresh({
+      getExpiryMs: () => 60_000,
+      now: () => 0,
+      onInvalid: () => {
+        invalidated = true;
+      },
+      refresh: async () => null,
+      setTimer: timers.setTimer
+    });
+
+    await timers.pending.shift()?.callback();
+    assert.equal(invalidated, true);
+    assert.equal(timers.pending.length, 0);
+  });
+});
diff --git a/apps/dashboard/src/services/tokenRefresh.ts b/apps/dashboard/src/services/tokenRefresh.ts
new file mode 100644
index 000000000..0825f3d05
--- /dev/null
+++ b/apps/dashboard/src/services/tokenRefresh.ts
@@ -0,0 +1,66 @@
+import type { AuthTokens } from "./auth";
+
+const TOKEN_REFRESH_SKEW_MS = 60 * 1000;
+const TOKEN_REFRESH_RETRY_MS = 30 * 1000;
+
+type Timer = ReturnType<typeof setTimeout>;
+type TimerCallback = () => void | Promise<void>;
+
+interface TokenRefreshOptions {
+  clearTimer?: (timer: Timer) => void;
+  getExpiryMs: () => number | null;
+  now?: () => number;
+  onInvalid: () => void;
+  refresh: () => Promise<AuthTokens | null>;
+  setTimer?: (callback: TimerCallback, delay: number) => Timer;
+}
+
+export function startTokenRefresh({
+  clearTimer = clearTimeout,
+  getExpiryMs,
+  now = Date.now,
+  onInvalid,
+  refresh,
+  setTimer = setTimeout
+}: TokenRefreshOptions): () => void {
+  let cancelled = false;
+  let timer: Timer | undefined;
+
+  const scheduleNext = () => {
+    if (cancelled) return;
+
+    const expiryMs = getExpiryMs();
+    const delay = expiryMs === null ? TOKEN_REFRESH_RETRY_MS : Math.max(expiryMs - now() - TOKEN_REFRESH_SKEW_MS, 0);
+
+    if (expiryMs === null) {
+      timer = setTimer(scheduleNext, delay);
+      return;
+    }
+
+    timer = setTimer(async () => {
+      if (cancelled) return;
+
+      try {
+        const refreshed = await refresh();
+        if (cancelled) return;
+
+        if (refreshed) {
+          scheduleNext();
+        } else {
+          onInvalid();
+        }
+      } catch {
+        if (!cancelled) {
+          timer = setTimer(scheduleNext, TOKEN_REFRESH_RETRY_MS);
+        }
+      }
+    }, delay);
+  };
+
+  scheduleNext();
+
+  return () => {
+    cancelled = true;
+    if (timer) clearTimer(timer);
+  };
+}
diff --git a/apps/dashboard/src/stores/auth.store.ts b/apps/dashboard/src/stores/auth.store.ts
index 07cb3fe85..4184b9e9b 100644
--- a/apps/dashboard/src/stores/auth.store.ts
+++ b/apps/dashboard/src/stores/auth.store.ts
@@ -4,7 +4,8 @@ import { queryClient } from "@/lib/queryClient";
 import { wagmiConfig } from "@/lib/wagmi";
 import { resetTransferState } from "@/machines/transferActor";
 import { AuthAPI } from "@/services/api/auth.api";
-import { AuthService } from "@/services/auth";
+import { AuthService, type AuthTokens } from "@/services/auth";
+import { restoreAuthSession } from "@/services/sessionRestore";
 import { useNotificationsStore } from "@/stores/notifications.store";
 
 interface AuthUser {
@@ -16,7 +17,7 @@ interface AuthUser {
 interface AuthState {
   user: AuthUser | null;
   requestOtp: (email: string) => Promise<void>;
-  restoreSession: () => void;
+  restoreSession: () => Promise<void>;
   verifyOtp: (email: string, code: string) => Promise<void>;
   logout: () => void;
 }
@@ -36,6 +37,10 @@ function userFromSession(): AuthUser | null {
   if (!tokens || !AuthService.isAuthenticated()) {
     return null;
   }
+  return userFromTokens(tokens);
+}
+
+function userFromTokens(tokens: AuthTokens): AuthUser {
   const email = tokens.userEmail ?? "";
   return { email, name: displayNameFromEmail(email), userId: tokens.userId };
 }
@@ -57,7 +62,14 @@ export const useAuthStore = create<AuthState>()(set => ({
   requestOtp: async email => {
     await AuthAPI.requestOTP(email);
   },
-  restoreSession: () => set({ user: userFromSession() }),
+  restoreSession: async () => {
+    const tokens = await restoreAuthSession({
+      refresh: () => AuthService.refreshAccessToken(),
+      tokens: AuthService.getTokens(),
+      verify: accessToken => AuthAPI.verifyToken(accessToken)
+    });
+    set({ user: tokens ? userFromTokens(tokens) : null });
+  },
   user: userFromSession(),
   verifyOtp: async (email, code) => {
     const result = await AuthAPI.verifyOTP(email, code);
diff --git a/docs/security-spec/01-auth/supabase-otp.md b/docs/security-spec/01-auth/supabase-otp.md
index 62888870a..118686813 100644
--- a/docs/security-spec/01-auth/supabase-otp.md
+++ b/docs/security-spec/01-auth/supabase-otp.md
@@ -10,7 +10,7 @@ The flow:
 3. Supabase verifies OTP and issues a JWT access token
 4. Frontend includes JWT in `Authorization: Bearer <token>` header on API requests
 5. API middleware (`supabaseAuth.ts`) verifies the JWT via `SupabaseAuthService.verifyToken()` and attaches `userId` to the request
-6. Access tokens are short-lived. The frontend refreshes them via `POST /v1/auth/refresh` (`SupabaseAuthService.refreshToken()` → Supabase `refreshSession`), scheduled just before expiry and also triggered on a `401` (single-flight refresh + one retry). The frontend never calls Supabase `refreshSession` directly with the anon key. The endpoint returns `401` **only** when the refresh token is confirmed invalid/revoked; transient upstream failures (Supabase unreachable / 5xx) return `503` so the frontend keeps the session and retries.
+6. Access tokens are short-lived. The widget and dashboard verify stored access tokens on startup and fall back to `POST /v1/auth/refresh` when verification fails. They also refresh through that endpoint just before expiry and after a `401` (single-flight refresh + one retry). The frontend never calls Supabase `refreshSession` directly with the anon key. The endpoint returns `401` **only** when the refresh token is confirmed invalid/revoked; transient upstream failures (Supabase unreachable / 5xx) return `503` so the frontend keeps the session and retries.
 
 Two middleware variants exist:
 - **`requireAuth`** — Returns 401 if token is missing or invalid. Used on protected endpoints.
@@ -32,7 +32,7 @@ Two middleware variants exist:
 
 | Threat | Attack Scenario | Mitigation |
 |---|---|---|
-| **Stolen JWT** | Attacker intercepts a user's JWT (XSS, network sniffing) and replays it | Short token expiry (Supabase default: 1 hour); TLS enforcement; HttpOnly cookies if applicable |
+| **Stolen JWT** | Attacker intercepts a user's JWT (XSS, network sniffing) and replays it | Configured token expiry (1 week); TLS enforcement; HttpOnly cookies if applicable |
 | **Supabase service key leak** | Attacker obtains `SUPABASE_SERVICE_KEY` and forges arbitrary JWTs | Key stored only in env vars; never exposed in responses or logs; rotation procedure in place |
 | **Supabase outage** | Supabase is unreachable — verification calls fail | `requireAuth` fails closed (returns 401); no fallback to unverified access |
 | **Email enumeration** | Attacker probes OTP endpoint to discover registered emails | OTP flow handled by Supabase — Vortex API never sees OTP requests; Supabase rate limits apply |
diff --git a/supabase/config.toml b/supabase/config.toml
index e50a4d2f0..31d89d746 100644
--- a/supabase/config.toml
+++ b/supabase/config.toml
@@ -149,7 +149,7 @@ site_url = "http://127.0.0.1:3000"
 # A list of *exact* URLs that auth providers are permitted to redirect to post authentication.
 additional_redirect_urls = ["https://127.0.0.1:3000"]
 # How long tokens are valid for, in seconds. Defaults to 3600 (1 hour), maximum 604,800 (1 week).
-jwt_expiry = 3600
+jwt_expiry = 604800
 # JWT issuer URL. If not set, defaults to the local API URL (http://127.0.0.1:<port>/auth/v1).
 # jwt_issuer = ""
 # Path to JWT signing key. DO NOT commit your signing keys file to git.