feat(clerk-js): Send previous session token on /tokens requests by nikosdouvlis · Pull Request #8105 · clerk/javascript

nikosdouvlis · 2026-03-18T13:17:05Z

Why

Session Minter needs the previous session JWT to clone claims at the edge without hitting the DB.

What

Send token (previous session JWT) in the POST body on non-template /tokens requests. Uses conditional spread so the key is absent (not token=) when there's no previous token.

The token param is currently ignored by the backend and will be wired up in PLAT-2471.

Test plan

Verify token appears in POST body when a previous token exists
Verify token key is absent on first mint
Verify token is not sent for template token requests
Existing token refresh flows still work

Summary by CodeRabbit

New Features
- Token refresh now sends the previous session token when available to support Session Minter edge token minting.
- New configuration flag to enable Session Minter behavior.
Tests
- Added tests verifying token refresh requests include the previous token when present, omit it for template-based mints, and preserve sign-in state.

vercel · 2026-03-18T13:17:10Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Mar 19, 2026 11:50pm

changeset-bot · 2026-03-18T13:17:10Z

🦋 Changeset detected

Latest commit: ecdb80a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Send the current session JWT as `token` in the POST body when requesting a token refresh. This lets the FAPI Proxy forward it to Session Minter for claim cloning without a DB read. Uses conditional spread so the key is absent (not `token=`) when there's no previous token (first mint).

Unit tests verify the token param is present when lastActiveToken exists, absent on first mint, absent for template requests, and matches getRawString() exactly. E2e test verifies token refresh still works with the new param in the POST body.

coderabbitai · 2026-03-18T14:07:11Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 4b284890-bfbb-44ac-a876-53af7f29491e

📥 Commits

Reviewing files that changed from the base of the PR and between 469fb9f and ecdb80a.

📒 Files selected for processing (2)

packages/clerk-js/bundlewatch.config.json
packages/clerk-js/src/core/resources/__tests__/AuthConfig.test.ts

📝 Walkthrough

Walkthrough

Adds session minter support by sending the previous session token in non-template /tokens requests when enabled. Extends AuthConfigJSON with session_minter?: boolean, adds sessionMinter to AuthConfig and AuthConfigResource, updates Session.#createTokenResolver to include lastActiveToken in the request body when sessionMinter is enabled, and adds unit and integration tests plus a changeset entry for a @clerk/clerk-js patch. Also adjusts a bundle size threshold in bundlewatch.config.json.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat(clerk-js): Send previous session token on /tokens requests' accurately summarizes the main change: adding logic to send the previous session token in the request body for /tokens endpoints to support Session Minter edge token minting.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

📝 Coding Plan

Generate coding plan for human review comments

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…nter flag Only send the previous session JWT in the POST body when the environment has session_minter enabled. This lets us roll out Session Minter incrementally via the environment config.

pkg-pr-new · 2026-03-19T11:30:38Z

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8105

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8105

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8105

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8105

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8105

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8105

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8105

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8105

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8105

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8105

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8105

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8105

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8105

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8105

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8105

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8105

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8105

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8105

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8105

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8105

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8105

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8105

commit: ecdb80a

…Config AuthConfig is the right home for this since it controls auth behavior, not environment-level display/maintenance settings.

The clerkMock() didn't provide __internal_environment.authConfig.sessionMinter, so the feature gate in #createTokenResolver was always falsy and token was never included in the request body, causing 3 test failures.

…imit Add session_minter to AuthConfig snapshot assertion. Bump clerk.browser.js bundlewatch limit from 66KB to 67KB to accommodate the new session minter code.

Resolve tokenCache.ts conflict by adopting main's orphan guard (cache.get(key) !== value short-circuit from #8098); drop the PR's redundant compare-and-swap. Monotonic enforcement remains at the broadcast handler, cookie write path, and Session resource where user-visible state lives. Drop stale changesets that were superseded by merged work: - session-minter-oiat-type.md (oiat field shipped via #8107) - session-minter-sdk-params.md (previous-token + force_origin shipped via #8105 + #8106 + #8107)

github-actionsBot added the clerk-js label Mar 18, 2026

nikosdouvlis mentioned this pull request Mar 18, 2026
feat(clerk-js): Send previous token and force_origin on /tokens requests #8096
Closed
6 tasks

vercelBotdeployed to Preview March 18, 2026 13:17 View deployment

nikosdouvlis force-pushed the nikos/plat-2566-send-token-on-refresh branch from f0b2a14 to cbc83a0Compare March 18, 2026 13:23

vercelBotdeployed to Preview March 18, 2026 13:24 View deployment

nikosdouvlis mentioned this pull request Mar 18, 2026
feat(clerk-js,shared): Remove expired_token retry flow #8108
Merged
3 tasks

github-actionsBot added the integration label Mar 18, 2026

vercelBotdeployed to Preview March 18, 2026 13:58 View deployment

nikosdouvlis marked this pull request as ready for review March 18, 2026 14:03

bratsos approved these changes Mar 18, 2026
View reviewed changes

feat(clerk-js): Gate previous token in /tokens body behind session_mi…
66d9de6
…nter flag Only send the previous session JWT in the POST body when the environment has session_minter enabled. This lets us roll out Session Minter incrementally via the environment config.

vercelBotdeployed to Preview March 19, 2026 11:28 View deployment

refactor(clerk-js): Move session_minter flag from Environment to Auth…
2b6ae78
…Config AuthConfig is the right home for this since it controls auth behavior, not environment-level display/maintenance settings.

vercelBotdeployed to Preview March 19, 2026 11:39 View deployment

fix(clerk-js): Add sessionMinter to test mock so feature gate passes
469fb9f
The clerkMock() didn't provide __internal_environment.authConfig.sessionMinter, so the feature gate in #createTokenResolver was always falsy and token was never included in the request body, causing 3 test failures.

vercelBotdeployed to Preview March 19, 2026 23:46 View deployment

fix(clerk-js): Update AuthConfig snapshot test and bump bundlewatch l…
ecdb80a
…imit Add session_minter to AuthConfig snapshot assertion. Bump clerk.browser.js bundlewatch limit from 66KB to 67KB to accommodate the new session minter code.

vercelBotdeployed to Preview March 19, 2026 23:50 View deployment

nikosdouvlis enabled auto-merge (squash) March 19, 2026 23:53

nikosdouvlis disabled auto-merge March 19, 2026 23:53

nikosdouvlis merged commit 2837336 into mainMar 19, 2026
42 of 44 checks passed

nikosdouvlis deleted the nikos/plat-2566-send-token-on-refresh branch March 19, 2026 23:53

clerk-cookie mentioned this pull request Mar 19, 2026
ci(repo): Version packages #8120
Merged

wobsoriano pushed a commit that referenced this pull request Mar 26, 2026
feat(clerk-js): Send previous session token on /tokens requests (#8105)
050879e

nikosdouvlis mentioned this pull request May 26, 2026
feat(clerk-js,shared): Backport Session Minter SDK changes to core-2 #8643
Merged
5 tasks

Navigation Menu

Uh oh!

feat(clerk-js): Send previous session token on /tokens requests - #8105

feat(clerk-js): Send previous session token on /tokens requests#8105
nikosdouvlis merged 6 commits into
mainfrom
nikos/plat-2566-send-token-on-refresh

nikosdouvlis commented Mar 18, 2026•
edited by coderabbitai Bot
Loading

Uh oh!

vercelBot commented Mar 18, 2026•
edited
Loading

Uh oh!

changeset-botBot commented Mar 18, 2026•
edited
Loading

Uh oh!

coderabbitaiBot commented Mar 18, 2026•
edited
Loading

Reviews paused

Walkthrough

Uh oh!

pkg-pr-newBot commented Mar 19, 2026•
edited
Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

nikosdouvlis commented Mar 18, 2026• edited by coderabbitai BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Test plan

Summary by CodeRabbit

Uh oh!

vercelBot commented Mar 18, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-botBot commented Mar 18, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

coderabbitaiBot commented Mar 18, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Uh oh!

pkg-pr-newBot commented Mar 19, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nikosdouvlis commented Mar 18, 2026•
edited by coderabbitai Bot
Loading

vercelBot commented Mar 18, 2026•
edited
Loading

changeset-botBot commented Mar 18, 2026•
edited
Loading

coderabbitaiBot commented Mar 18, 2026•
edited
Loading

pkg-pr-newBot commented Mar 19, 2026•
edited
Loading