AccessToken don't update when we request customerAccessTokenRenew API

Retired Boards Appdev Custom Storefronts
1

Hi,

I created access token by using customerAccessTokenCreate API and I confirmed whether the access token update when requesting customerAccessTokenRenew API. I expected it updated renew access token. However, it wasn’t changed and expiresAt was only updated.

My questions are following.

  1. Is the behavior right?
  2. When access token will be renew?
    • I confirmed renewing access token when resetting password.
    • Besides, I also confirmed that shortly requesting customerAccessTokenCreate API updated only expiresAt.

Thank you for your help

2

Sample

At first, I created customer access token and got “e1dc3a6bfcc61df6bf324ace********”. And, I would renew access token.

request

mutation customerAccessTokenRenew($customerAccessToken: String!) {
  customerAccessTokenRenew(customerAccessToken: $customerAccessToken) {
    customerAccessToken {
      accessToken
      expiresAt
    }
    userErrors {
      field
      message
    }
  }
}

variables

{
    "customerAccessToken": "e1dc3a6bfcc61df6bf324ace********"
}

response

expected

{
    "data": {
        "customerAccessTokenRenew": {
            "customerAccessToken": {
                "accessToken": "hogefugeaccesstoken", # I accepted to get new access token
                "expiresAt": "2022-09-06T10:34:22Z"
            },
            "userErrors": []
        }
    }
}

got

{
    "data": {
        "customerAccessTokenRenew": {
            "customerAccessToken": {
                "accessToken": "e1dc3a6bfcc61df6bf324ace********",
                "expiresAt": "2022-09-06T10:34:22Z" # ExpiresAt was only updated.
            },
            "userErrors": []
        }
    }
}
3

This is expected behaviour, renewing an access token extends how long it can be used, if you want an entirely new token use customerAccessTokenCreate instead.

4

@c10s

Thank you for your replying.

I expected customerAccessTokenCreate recreate customerAccessToken. But, it only updated the expiresAt, not create new token. So, I don’t understand when and how to use customerAccessTokenCreate and customerAccessTokenRenew