Good evening,
I have a question regarding the required migration to the expiring offline access tokens (Migrate to expiring offline access tokens).
We are currently implementing the necessary changes and noticed that even after the non-expiring offline token has been successfully exchanged for the expiring access token (which we can successfully use for subsequent GraphQL API calls, including the occasional refresh of the new token), going back to the “original” non-expiring access token still works i.e. API calls still succeed.
The migration guide clearly states that:
Migration permanently invalidates the old token for GraphQL Admin API requests. Store the access token and refresh token returned by the exchange.
which is why we found this behaviour surprising. Is this behaviour expected?
Thank you!
Piotr