What are best practices for storing and refreshing OAuth 2.0 tokens in a SPA?

[Nora59]

I'm implementing user authentication for a new internal web application that needs to integrate with our existing corporate identity provider using OAuth 2.0. While I understand the basic authorization code flow, I'm confused about the best practices for securely storing and refreshing access tokens on the client side, especially in a single-page application where traditional server-side sessions aren't used. For developers who have built secure SPA authentication, what patterns or libraries do you recommend for managing the token lifecycle and mitigating common security risks like CSRF or token leakage?