FAQ: How does customer authentication renewal work in my store? Is it possible to extend this period?

VTEX in your native language 🌎 Portuguese
1

The goal of this topic is to explain how the authentication renewal process works for a logged-in user on a VTEX store, as well as how to extend that timeframe. To learn more about general aspects of the authentication process, I recommend reading the following documentation: https://developers.vtex.com/docs/guides/api-authentication-using-user-tokens

Considering the context of user authentication on the store front, there are two cookies related to the login session in the store:

  • VtexidClientAutCookie_{{account}} - always expires in 24 hours.
  • vid_rt - the refresh token that expires in 7 days by default.

Session login supports up to 30 days across all our online stores (IO and Portal). This means that a user who authenticates once in your account can go up to 30 days without renewing that authentication and remain logged in.

Client credential cookies are renewed periodically. However, it is configurable for this renewal to happen every 1/7/30 days.

To request a change to the session duration, you need to open a ticket with our support team at the following link: https://help.vtex.com/support?/cultureInfo=pt-br

:warning: Note that this authentication persistence flow does not work in a headless manner, meaning it will not work on fronts that are not VTEX-native and/or mobile apps.

If you still have any questions about this topic, feel free to ask here! We’d be happy to answer and help you out!

2

Good afternoon Eduardo, could you share the reason why this implementation doesn’t work in Headless?

Wouldn’t it be possible to implement something equivalent in Headless?

3

Hi, @RamonRibeiro! Good afternoon! How’s it going?

The API and service responsible for refreshing the token depend on some properties stored in the client’s session context, and only VTEX’s native frontends — such as CMS Legacy, Store Framework, and Faststore — are allowed to access these properties. As such, any Headless frontend, even if it uses the refresh API, will not be able to successfully renew the authentication token after 24 hours.

The update to this authentication flow to make it work in a headless context is currently being evaluated by our product team, and as soon as we have any progress on this front, we’ll publish it through our official channels.

At this time, we don’t have a workaround. The customer, on a headless channel, will need to authenticate again after 24 hours.

4

Is there any news on this topic?

5

Is there an update related to this?

6

Hey @EduardoBarbosa27 I came across this headless implementation doc but I’m running into the following issue — when sending a request to the vid_rt update endpoint (via Postman), it doesn’t return the ‘set-Cookie’ header as described in the documentation. Has there been any update on this topic?