Changelog

Single active storefront session per customer

Storefront customer sessions are single-active: signing a customer in again or signing them out invalidates every customer access token previously issued for that account, not just the session that triggered the change.

• One session per customer account — every sign-in method rotates the underlying session token and ends the customer’s other sessions. This covers a storefront sign-in, the Customer Login API access point URL (/login/token/{token}), the GraphQL Storefront API login and loginWithCustomerLoginJwt mutations, and flows built on them, such as a B2B Edition buyer portal sign-in. Sign-out invalidates the customer access token the same way.
• expiresAt is a latest-possible expiry, not a guaranteed lifetime — a customer access token can stop working earlier than its expiresAt value because the customer signed in again or signed out.
• Invalidated tokens do not return errors — a GraphQL request that carries an invalidated customer access token runs as an anonymous shopper: the customer field returns null, and customer-specific values such as customer-group pricing fall back to guest values. To make such requests return an explicit error instead, send the X-BC-Error-On-Invalid-Customer-Access-Token header with a value of true.
• For headless storefronts and integrations — store at most one customer access token per customer account and replace it with the newest token after each sign-in, consolidate the customer’s sign-in flows on a single method, and treat a null customer response as a signal to prompt the customer to sign in again.

For details, see Customer session behavior.