Default GhEx.TokenCache: an ETS table owned by a GenServer.

Add it to your supervision tree so it outlives individual requests:

children = [
  GhEx.TokenCache.ETS
  # or, to run more than one or pick the name:
  # {GhEx.TokenCache.ETS, name: MyApp.GitHubTokens}
]

Then point installation clients at it:

inst = GhEx.App.installation(app, installation_id, cache: GhEx.TokenCache.ETS)

Reads take the fast path straight from the public ETS table with no process hop. Misses and near-expiry refreshes are serialized through the GenServer, which double-checks the table before minting, so concurrent callers for the same installation trigger a single mint (single-flight). Serialization is global across keys, which is fine because mints are rare (about once per hour per installation); shard by running multiple named caches if you ever need to.

A token is considered fresh until 60 seconds before its expires_at, so a refresh happens slightly ahead of the real expiry.