I have a project that consist of two parts a Next.js (14) frontend and a separate backend.
When the user authenticates, the backend returns an object containing both the accessToken and refreshToken
I need to store these in the users cookies, and then include them in each request to the backend in the authorization header. If I could use cookies on the backend, I could have just done credentials: "include". But the backend is serving other platforms as well, and we want a uniform auth flow on the backend.

Since the accessToken is short lived (TTL 1h) I need to repeatedly refresh the tokens. So I have a a server action (getTokens) that calls cookies(), checks that the accessToken is valid for at least 1 min, and if not, it performs a fetch to the backends [POST] /authorization/refresh-tokens endpoint.
Once the new tokens are returned, I need to update the stored cookies, and then return the new accessToken.
But when I try to write to the store, I get an error saying Cookies can only be modified in a Server Action or Route Handler.

I'm still in the same getTokens function, I'm even using the same cookieStore instance that I was using in the beginning of the function, I have also tried just using a new cookies() call for setting each new token.

I then use the getToken action in my other server actions that requires authentication to get the token and include it in the fetch request.

I'm using both 'use server'; and server-only So if the function wasn't run server side, I would expect other errors.

get-token.ts:

'use server';
import { cookies } from 'next/headers';

import 'server-only';

import { Tokens } from '../types';
import { TokenPayload } from '../types/token-payloads';

const SECOND_IN_MS = 1000;
const MINUTE_IN_MS = 60 * SECOND;

/**
 * Returns the access token to use for API requests against the backend
 * If the token is expired, it will be refreshed
 * If it's unable to refresh the token, it will throw an error
 * @returns accessToken
 */
export async function getToken(): Promise<string | undefined> {
  const cookieStore = cookies();
  const token = cookieStore.get('token');
  const refreshToken = cookieStore.get('refreshToken');

  if (token?.value) {
    // check if token is expiring
    const {exp}: TokenPayload = JSON.parse(atob(token.value.split('.')[1]));
    const now = Date.now();
    // if token have more than 1 minute left, return it
    if (now - exp > MINUTE_IN_MS) return token.value;
  }

  // if no refresh token, we can't refresh the token
  if (!refreshToken?.value) throw new Error('NO_TOKEN');

  const result = await fetch(
    `${process.env.API_URL}/authentication/refresh-tokens`,
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
      },
      body: JSON.stringify({ refreshToken: refreshToken.value }),
    }
  );

  if (!result.ok) throw new Error('NO_TOKEN');
  const tokens: Tokens = await result.json();
  // if unable to refresh token, return undefined
  if (!tokens) throw new Error('NO_TOKEN');

  // set the new tokens
  // Have also tried `cookies().set`
  cookieStore.set('token', tokens.accessToken, {
    httpOnly: true,
    maxAge: parseInt(process.env.JWT_ACCESS_TOKEN_TTL!, 10),
  });

  cookieStore.set('refreshToken', tokens.refreshToken, {
    httpOnly: true,
    maxAge: parseInt(process.env.JWT_REFRESH_TOKEN_TTL!, 10),
  });

  cookieStore.set('user', JSON.stringify(tokens.user), {
    httpOnly: false,
  });

  return tokens.accessToken;
}