diff --git a/openapi/hello/hello.go b/openapi/hello/hello.go
index aca18b92..08b471b1 100644
--- a/openapi/hello/hello.go
+++ b/openapi/hello/hello.go
@@ -1,6 +1,7 @@
 package hello
 
 import (
+	"io"
 	"net/http"
 	"time"
 
@@ -23,29 +24,53 @@ func Attach(group *gin.RouterGroup, oauth types.OAuth) {
 
 func helloWorldPublic(c *gin.Context) {
 	serverTime := time.Now().Format(time.RFC3339)
+
+	// Get query string as raw string
+	queryString := c.Request.URL.RawQuery
+
+	// Get post payload
+	var postPayload string
+	if body, err := io.ReadAll(c.Request.Body); err == nil {
+		postPayload = string(body)
+	}
+
 	c.JSON(http.StatusOK, gin.H{
-		"MESSAGE":     "HELLO, WORLD",
-		"SERVER_TIME": serverTime,
-		"VERSION":     share.VERSION,
-		"PRVERSION":   share.PRVERSION,
-		"CUI":         share.CUI,
-		"PRCUI":       share.PRCUI,
-		"APP":         share.App.Name,
-		"APP_VERSION": share.App.Version,
+		"MESSAGE":      "HELLO, WORLD",
+		"SERVER_TIME":  serverTime,
+		"VERSION":      share.VERSION,
+		"PRVERSION":    share.PRVERSION,
+		"CUI":          share.CUI,
+		"PRCUI":        share.PRCUI,
+		"APP":          share.App.Name,
+		"APP_VERSION":  share.App.Version,
+		"QUERYSTRING":  queryString,
+		"POST_PAYLOAD": postPayload,
 	})
 }
 
 // helloWorldHello is the handler for the hello world endpoint
 func helloWorldProtected(c *gin.Context) {
 	serverTime := time.Now().Format(time.RFC3339)
+
+	// Get query string as raw string
+	queryString := c.Request.URL.RawQuery
+
+	// Get post payload
+	var postPayload string
+	if body, err := io.ReadAll(c.Request.Body); err == nil {
+		postPayload = string(body)
+	}
+
 	c.JSON(http.StatusOK, gin.H{
-		"MESSAGE":     "HELLO, WORLD",
-		"SERVER_TIME": serverTime,
-		"VERSION":     share.VERSION,
-		"PRVERSION":   share.PRVERSION,
-		"CUI":         share.CUI,
-		"PRCUI":       share.PRCUI,
-		"APP":         share.App.Name,
-		"APP_VERSION": share.App.Version,
+		"MESSAGE":      "HELLO, WORLD",
+		"SERVER_TIME":  serverTime,
+		"VERSION":      share.VERSION,
+		"PRVERSION":    share.PRVERSION,
+		"CUI":          share.CUI,
+		"PRCUI":        share.PRCUI,
+		"APP":          share.App.Name,
+		"APP_VERSION":  share.App.Version,
+		"QUERYSTRING":  queryString,
+		"POST_PAYLOAD": postPayload,
 	})
 }
diff --git a/openapi/oauth/guard.go b/openapi/oauth/guard.go
index 6875d820..c0414ed8 100644
--- a/openapi/oauth/guard.go
+++ b/openapi/oauth/guard.go
@@ -3,14 +3,16 @@ package oauth
 import (
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/gin-gonic/gin"
+	"github.com/yaoapp/yao/openapi/oauth/types"
 )
 
 // Guard is the OAuth guard middleware
 func (s *Service) Guard(c *gin.Context) {
 	// Get the token from the request
-	token := c.GetHeader("Authorization")
+	token := s.getAccessToken(c)
 
 	// Validate the token
 	if token == "" {
@@ -20,11 +22,58 @@ func (s *Service) Guard(c *gin.Context) {
 	}
 
 	// Validate the token
-	_, err := s.VerifyToken(strings.TrimPrefix(token, "Bearer "))
+	claims, err := s.VerifyToken(token)
 	if err != nil {
 		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid token"})
 		c.Abort()
 		return
 	}
 
+	// Auto refresh the token
+	if claims.ExpiresAt.Before(time.Now()) {
+		s.tryAutoRefreshToken(c, claims)
+	}
+}
+
+func (s *Service) tryAutoRefreshToken(c *gin.Context, _ *types.TokenClaims) {
+	refreshToken := s.getRefreshToken(c)
+	if refreshToken == "" {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Unauthorized"})
+		c.Abort()
+		return
+	}
+
+	// Verify the refresh token
+	_, err := s.VerifyToken(refreshToken)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "Invalid token"})
+		c.Abort()
+		return
+	}
+
+	// @Todo: Auto refresh the token
+}
+
+func (s *Service) getAccessToken(c *gin.Context) string {
+	token := c.GetHeader("Authorization")
+	if token == "" {
+		cookie, err := c.Cookie("__Host-access_token")
+		if err != nil {
+			return ""
+		}
+		token = cookie
+	}
+	return strings.TrimPrefix(token, "Bearer ")
+}
+
+func (s *Service) getRefreshToken(c *gin.Context) string {
+	token := c.GetHeader("Authorization")
+	if token == "" {
+		cookie, err := c.Cookie("__Host-refresh_token")
+		if err != nil {
+			return ""
+		}
+		token = cookie
+	}
+	return strings.TrimPrefix(token, "Bearer ")
 }