Most sellers never need to think about how cookie refresh works — Closo handles it. But for the curious power user or the technical reseller who wants to understand the system, here is the actual mechanism. The upkeep happens through the Closo browser extension, with a few cooperating pieces, each catching what the others miss.
Why this is a problem at all
Every marketplace gives out short-lived session cookies — somewhere between 15 minutes (Vinted) and 4 hours (Depop). When those cookies expire, Closo cannot post on your behalf to that marketplace, because the marketplace no longer trusts the request as coming from you.
Keeping them fresh quietly — without bothering you, without tripping bot walls — is one of the hardest engineering problems in resale tooling. Closo solves it from inside your browser, where the marketplace already trusts you.
Passive read from your browser
Every time you browse Poshmark, Vinted, Depop, or Mercari in your Chrome browser, the Closo extension reads the freshest cookies from that browsing session and sends them to Closo's encrypted vault. This is your baseline — for most marketplaces, your normal browsing is what keeps the connection alive.
Cookies in the vault are encrypted at rest. The extension never sends content from any other site — only the marketplaces you have connected.
Event-driven proactive refresh
Closo doesn't poll your cookies on a fixed minute-by-minute timer. Instead it checks when there's work to do: when an action is dispatched or queued for a marketplace, Closo looks at that cookie's age. If the cookie is within 20% of its expiry (about 6 minutes left on a 30-minute cookie, for example), it triggers a refresh before the cookie actually dies. An hourly safety sweep runs as a backstop in case nothing has been dispatched recently.
A 60-second debounce prevents thundering-herd retries — if two triggers want to refresh the same cookie at the same time, only one fires.
Scheduled session refresh — Vinted
Vinted is the one marketplace with an active scheduled session refresh. The Closo extension wakes about every 30 minutes and refreshes your Vinted session from inside your own Chrome — using your real browser context and IP. The other marketplaces don't have a scheduled session refresh; they rely on the cookie capture from your normal browsing plus the event-driven proactive refresh above.
Repeated-failure detection
When a marketplace's refresh fails 5 or more times within 12 hours, Closo gets your attention. The marketplace badge in your sidebar turns yellow. A bell notification appears. On Unlimited, an email follows so the alert reaches you even when you are not in Closo. And scheduled work for that marketplace pauses until you reconnect — so we do not waste your daily Action budget retrying something that will not work.
Why marketplaces differ
Each marketplace's bot detection has different rules. Cloudflare (used by Mercari) inspects the technical signature of every request and demands occasional human signals. Akamai (used by Poshmark) measures behavioral patterns over many sessions. Datadome (used by Depop and Vinted) issues one-shot tokens that must be redeemed within a short window. Different cookies, different lifetimes, different walls — which is why the freshest material always comes from a real browser session, i.e. yours.
Honest limits
What you can do
Open marketplace tabs in your normal Chrome every few days, for a few minutes. Because the connection upkeep is extension-side, this is the single most effective thing you can do — it re-warms the bot-detection scores with a fresh human signal and gives the extension fresh cookies to capture. And let the smart alerts guide you: when Closo cannot fix something itself, it tells you. Two minutes of your attention can save a day of silent retries.
Everything else, the system handles. The point is that you do not have to know which piece is doing the work at any given moment — only that, as long as the extension is installed and you browse now and then, the work is getting done.