Skip to content

fix: access token not persisted after token refresh#40013

Merged
chaitanyapotti merged 9 commits intomainfrom
fix/access-token-not-persisted
Feb 13, 2026
Merged

fix: access token not persisted after token refresh#40013
chaitanyapotti merged 9 commits intomainfrom
fix/access-token-not-persisted

Conversation

@lwin-kyaw
Copy link
Contributor

@lwin-kyaw lwin-kyaw commented Feb 12, 2026

Description

This PR fixes the accessToken not being persisted across lock/unlock cycles issue in the seedless onboarding flow and upgrades @metamask/seedless-onboarding-controller from v7.1.0 to v8.0.0.

Problem:
Previously, the OAuthService was reading the accessToken directly from SeedlessOnboardingController state via SeedlessOnboardingController:getState. The access token was not persisted in the controller state, causing it to be lost after a lock/unlock cycle. Additionally, when the token expired, there was no mechanism to automatically refresh it before making API calls (e.g., marketing opt-in).

Solution:

  • Updated to @metamask/seedless-onboarding-controller v8.0.0 which exposes a new SeedlessOnboardingController:getAccessToken action that handles token retrieval and automatic refresh when expired.
  • Replaced direct state access (SeedlessOnboardingController:getStateaccessToken) with the new SeedlessOnboardingController:getAccessToken action in OAuthService.
  • Improved error handling in BaseLoginHandler by introducing createErrorFromNetworkRequest utility to provide more descriptive error messages (including status codes and response body) for token-related network failures (auth token, refresh, revoke, renew).
  • Added new OAuthErrorMessages enum entries for granular error categorization.
  • Removed the unused NO_AUTH_CODE_FOUND_ERROR enum value and updated the welcome page error handling accordingly.
  • Added E2E tests to verify token refresh behavior and access token validity after lock/unlock cycles.

Open in GitHub Codespaces

Changelog

CHANGELOG entry: Fixed access token not persisting across lock/unlock cycles for seedless onboarding users

Related issues

Fixes: #39566
Relates to: #40011

Manual testing steps

  1. Enable seedless onboarding feature flag and start a dev build (yarn start)
  2. Go through the seedless onboarding flow using social login (Google)
  3. After onboarding completes, lock the wallet
  4. Unlock the wallet with your password
  5. Navigate to Settings → Privacy & Security
  6. Verify that the marketing consent settings load correctly (this confirms the access token was refreshed and used successfully)
  7. Verify no errors appear in the console related to "No access token found"

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Medium Risk
Touches seedless onboarding OAuth token retrieval/refresh paths and bumps a core controller dependency, which could affect authentication and downstream API calls if integration mismatches. Changes are mitigated by added unit/E2E coverage around failure cases and lock/unlock refresh flows.

Overview
Fixes seedless onboarding marketing-consent calls failing after lock/unlock by switching OAuthService to fetch tokens via the new SeedlessOnboardingController:getAccessToken action (delegated through the OAuth service messenger/types) instead of reading accessToken from controller state.

Improves OAuth/Auth-server failure visibility by adding createErrorFromNetworkRequest and expanding OAuthErrorMessages, then wiring these into BaseLoginHandler (token/refresh/revoke/renew) and updating unit tests accordingly; also removes the unused NO_AUTH_CODE_FOUND_ERROR handling in the onboarding welcome UI.

Upgrades @metamask/seedless-onboarding-controller to ^8.0.0 and adds/updates E2E mocking + a new E2E spec to validate token refresh behavior and access-token validity across lock/unlock cycles.

Written by Cursor Bugbot for commit 5db5ced. This will update automatically on new commits. Configure here.

@github-actions
Copy link
Contributor

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@metamaskbot metamaskbot added the team-onboarding Onboarding team label Feb 12, 2026
@lwin-kyaw lwin-kyaw changed the title Fix/access token not persisted fix: access token not persisted after token refresh Feb 12, 2026
@metamaskbotv2
Copy link
Contributor

metamaskbotv2 bot commented Feb 12, 2026

✨ Files requiring CODEOWNER review ✨

🔐 @MetaMask/web3auth (1 files, +1 -4)
  • 📁 ui/
    • 📁 pages/
      • 📁 onboarding-flow/
        • 📁 welcome/
          • 📄 welcome.tsx +1 -4

@socket-security
Copy link

socket-security bot commented Feb 12, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​metamask/​seedless-onboarding-controller@​7.1.0 ⏵ 8.0.09810078 +194 -2100

View full report

@metamaskbotv2
Copy link
Contributor

metamaskbotv2 bot commented Feb 12, 2026

Builds ready [c66ef43]
UI Startup Metrics (1341 ± 90 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup1341116915749013801523
load115098613298111931303
domContentLoaded114397913248211881298
domInteractive251579162273
firstPaint145661114116191241
backgroundConnect23421727912236260
firstReactRender1710184171725
initialActions107114
loadScripts9237611110829701075
setupStore1163441316
numNetworkReqs231599211584
BrowserifyPower User HomeuiStartup186813711078595418252322
load11501027165215211491604
domContentLoaded11341018162114611381560
domInteractive37181632932121
firstPaint1597242673203288
backgroundConnect3902805072493335486
firstReactRender2215109102334
initialActions105112
loadScripts89677913891398941281
setupStore1564261724
numNetworkReqs1214826045143203
WebpackStandard HomeuiStartup8326951074898801017
load71861693783761876
domContentLoaded71361293182757869
domInteractive261693202284
firstPaint1006031048104211
backgroundConnect2817103123043
firstReactRender15105061724
initialActions104112
loadScripts71061092981755865
setupStore1264861224
numNetworkReqs231599221584
WebpackPower User HomeuiStartup1196869238121512721607
load70059215961476881052
domContentLoaded69158715881466771037
domInteractive38182233930151
firstPaint152601046121185303
backgroundConnect17114335245166297
firstReactRender21163032227
initialActions103111
loadScripts68858515821456751029
setupStore1145161217
numNetworkReqs1254529154148261
FirefoxBrowserifyStandard HomeuiStartup15301322231618815711939
load13201138182014013811613
domContentLoaded13191138181914013801612
domInteractive63322683887130
firstPaint------
backgroundConnect54292353052104
firstReactRender1191811214
initialActions102012
loadScripts12951115173513513541586
setupStore12657101338
numNetworkReqs2413100221784
BrowserifyPower User HomeuiStartup28182103404137830383567
load16081285258724216592109
domContentLoaded16081285258724216592109
domInteractive13838750124125396
firstPaint------
backgroundConnect3331171115250415917
firstReactRender19147561923
initialActions206122
loadScripts15611265255122716012022
setupStore13910760193117627
numNetworkReqs76361503196135
WebpackStandard HomeuiStartup16131364232514516741836
load13831192176510314391530
domContentLoaded13831186176510314371530
domInteractive852718640123142
firstPaint------
backgroundConnect58262303558125
firstReactRender16116181524
initialActions103122
loadScripts1355117716779614131497
setupStore196178271454
numNetworkReqs241392201779
WebpackPower User HomeuiStartup27161822399747228933641
load15141251242825316241973
domContentLoaded15131251242825316231973
domInteractive14129736157122549
firstPaint------
backgroundConnect295761020213321838
firstReactRender22156462430
initialActions103122
loadScripts14771229240424615871931
setupStore1588812206151639
numNetworkReqs74371683492136
📊 Page Load Benchmark Results

Current Commit: c66ef43 | Date: 2/12/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.05s (±72ms) 🟡 | historical mean value: 1.04s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 737ms (±68ms) 🟢 | historical mean value: 728ms ⬆️ (historical data)
  • firstContentfulPaint-> current mean value: 78ms (±11ms) 🟢 | historical mean value: 79ms ⬇️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.05s 72ms 1.01s 1.34s 1.30s 1.34s
domContentLoaded 737ms 68ms 699ms 1.00s 958ms 1.00s
firstPaint 78ms 11ms 64ms 172ms 92ms 172ms
firstContentfulPaint 78ms 11ms 64ms 172ms 92ms 172ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 300.74 KiB (7.5%)
  • ui: 928 Bytes (0.01%)
  • common: 10.28 KiB (0.09%)

@lwin-kyaw
Copy link
Contributor Author

@metamaskbot update-policies

@metamaskbot
Copy link
Collaborator

Policies updated.
👀 Please review the diff for suspicious new powers.

🧠 Learn how: https://lavamoat.github.io/guides/policy-diff/#what-to-look-for-when-reviewing-a-policy-diff

👀 lavamoat/browserify/beta/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/browserify/experimental/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/browserify/flask/policy.json changes differ from main/policy.json policy changes
👀 lavamoat/webpack/mv2/beta/policy.json changes differ from mv2/main/policy.json policy changes
👀 lavamoat/webpack/mv2/experimental/policy.json changes differ from mv2/main/policy.json policy changes
👀 lavamoat/webpack/mv2/flask/policy.json changes differ from mv2/main/policy.json policy changes
✅ lavamoat/webpack/mv3/beta/policy.json changes match mv3/main/policy.json policy changes
✅ lavamoat/webpack/mv3/experimental/policy.json changes match mv3/main/policy.json policy changes
✅ lavamoat/webpack/mv3/flask/policy.json changes match mv3/main/policy.json policy changes

Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

@lwin-kyaw lwin-kyaw removed request for a team February 12, 2026 14:27
@metamaskbotv2
Copy link
Contributor

metamaskbotv2 bot commented Feb 12, 2026

Builds ready [14b32a8]
UI Startup Metrics (1378 ± 107 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup13781194184010714291567
load118599515329612351345
domContentLoaded117899115169412301338
domInteractive2816120212379
firstPaint166681206128213291
backgroundConnect24122230513245265
firstReactRender17113951929
initialActions109113
loadScripts95476712789410031114
setupStore1363251425
numNetworkReqs231590201581
BrowserifyPower User HomeuiStartup17161394294419817911977
load11491034233619111241655
domContentLoaded11331025225718011141581
domInteractive35181642634101
firstPaint187711582167222407
backgroundConnect31828353929322356
firstReactRender22155152334
initialActions103111
loadScripts89378218621698711332
setupStore1564261826
numNetworkReqs1184825945142202
WebpackStandard HomeuiStartup85070411671019321016
load739605100199825898
domContentLoaded73360199598819891
domInteractive271697192482
firstPaint1156464271133206
backgroundConnect26166193141
firstReactRender15103451823
initialActions105112
loadScripts73059998697810889
setupStore1264151320
numNetworkReqs231591201581
WebpackPower User HomeuiStartup1215837192916113061467
load71162711101127011028
domContentLoaded70262211011126881020
domInteractive36181472833107
firstPaint1316351982138282
backgroundConnect16513033844162262
firstReactRender22173232327
initialActions104111
loadScripts69962010911106861010
setupStore1144251317
numNetworkReqs1194428055147248
FirefoxBrowserifyStandard HomeuiStartup16271399223716916971998
load13961211185913214701651
domContentLoaded13951211185913214691651
domInteractive873434348116151
firstPaint------
backgroundConnect59291472465118
firstReactRender13102421317
initialActions103122
loadScripts13691185180412614421601
setupStore177190241461
numNetworkReqs241291201785
BrowserifyPower User HomeuiStartup27202124462739328233484
load15451284246425115712150
domContentLoaded15451283245825115712149
domInteractive13434742138119412
firstPaint------
backgroundConnect283124968236256894
firstReactRender211576132162
initialActions203122
loadScripts15101256240624415342093
setupStore1457780203168685
numNetworkReqs66391353389129
WebpackStandard HomeuiStartup16551332232513517011879
load1428122817319114781591
domContentLoaded1427122817319014781590
domInteractive1003023448132158
firstPaint------
backgroundConnect58251663061123
firstReactRender14112121519
initialActions103122
loadScripts1398120816978814511545
setupStore176160231350
numNetworkReqs231391181877
WebpackPower User HomeuiStartup28531945880292329134107
load16891272742380417082368
domContentLoaded16891271742380417082368
domInteractive15634823180119589
firstPaint------
backgroundConnect303791334253276920
firstReactRender22157162429
initialActions203123
loadScripts16451255738079616672256
setupStore1838784222276676
numNetworkReqs66381443091122
📊 Page Load Benchmark Results

Current Commit: 14b32a8 | Date: 2/12/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.04s (±39ms) 🟡 | historical mean value: 1.04s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 727ms (±36ms) 🟢 | historical mean value: 724ms ⬆️ (historical data)
  • firstContentfulPaint-> current mean value: 79ms (±12ms) 🟢 | historical mean value: 76ms ⬆️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.04s 39ms 1.02s 1.33s 1.06s 1.33s
domContentLoaded 727ms 36ms 703ms 991ms 746ms 991ms
firstPaint 79ms 12ms 64ms 192ms 84ms 192ms
firstContentfulPaint 79ms 12ms 64ms 192ms 84ms 192ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 300.74 KiB (7.5%)
  • ui: 928 Bytes (0.01%)
  • common: 10.28 KiB (0.09%)

@metamaskbotv2
Copy link
Contributor

metamaskbotv2 bot commented Feb 12, 2026

Builds ready [5db5ced]
UI Startup Metrics (1407 ± 105 ms)
PlatformBuildTypePageMetricMean (ms)Min (ms)Max (ms)Std Dev (ms)P 75 (ms)P 95 (ms)
ChromeBrowserifyStandard HomeuiStartup14071217188510514781547
load1205100516269512671334
domContentLoaded1198100115959412611327
domInteractive2716127202476
firstPaint2136714122742071121
backgroundConnect24321834318247276
firstReactRender1710166151823
initialActions107113
loadScripts97178013669410301103
setupStore1262641318
numNetworkReqs231584201582
BrowserifyPower User HomeuiStartup19671377627084818293904
load11441002223019511271598
domContentLoaded1124995210518011181508
domInteractive4018566593499
firstPaint229682129232250335
backgroundConnect47227639585953351414
firstReactRender22154952431
initialActions103011
loadScripts89776818231718971273
setupStore1573861630
numNetworkReqs1164425445140222
WebpackStandard HomeuiStartup88471113201149551092
load7656311235107844919
domContentLoaded7596261227107839912
domInteractive291999182682
firstPaint1226544765149234
backgroundConnect28207593244
firstReactRender15103041823
initialActions104112
loadScripts7566241225106836908
setupStore1353451326
numNetworkReqs231598201579
WebpackPower User HomeuiStartup1207917187017713041447
load71562911491117021011
domContentLoaded70562311351116921002
domInteractive3518207283497
firstPaint1416353798148385
backgroundConnect15713235138156230
firstReactRender22173232427
initialActions103111
loadScripts7026211128109690993
setupStore1244451317
numNetworkReqs1164527349145182
FirefoxBrowserifyStandard HomeuiStartup15941368234217816211928
load13791197211914614191648
domContentLoaded13791197211314514181648
domInteractive74322674697152
firstPaint------
backgroundConnect57341942755105
firstReactRender12102221314
initialActions103112
loadScripts13521174209014013961620
setupStore156118161331
numNetworkReqs241498211786
BrowserifyPower User HomeuiStartup27632177404240329093603
load15521316239722516072044
domContentLoaded15521316239722516062044
domInteractive14035654125136427
firstPaint------
backgroundConnect3011051296250304936
firstReactRender211594132028
initialActions203122
loadScripts15081296233520815341998
setupStore1688785209216625
numNetworkReqs73371933491138
WebpackStandard HomeuiStartup16811418319220217051970
load14511225300718714851666
domContentLoaded14501220300218614851666
domInteractive119291614158133207
firstPaint------
backgroundConnect60292633761138
firstReactRender15112521519
initialActions103122
loadScripts14231208298518514561594
setupStore186178321354
numNetworkReqs231395191775
WebpackPower User HomeuiStartup27331978422844128003680
load15281277265827516682090
domContentLoaded15271273265827516682090
domInteractive145311304179115537
firstPaint------
backgroundConnect34911814652984001039
firstReactRender24167092532
initialActions216123
loadScripts14891243263425816292004
setupStore2009783243340730
numNetworkReqs703615632100125
📊 Page Load Benchmark Results

Current Commit: 5db5ced | Date: 2/12/2026

📄 Localhost MetaMask Test Dapp

Samples: 100

Summary

  • pageLoadTime-> current mean value: 1.04s (±37ms) 🟡 | historical mean value: 1.03s ⬆️ (historical data)
  • domContentLoaded-> current mean value: 722ms (±35ms) 🟢 | historical mean value: 720ms ⬆️ (historical data)
  • firstContentfulPaint-> current mean value: 75ms (±11ms) 🟢 | historical mean value: 76ms ⬇️ (historical data)

📈 Detailed Results

Metric Mean Std Dev Min Max P95 P99
pageLoadTime 1.04s 37ms 1.01s 1.31s 1.07s 1.31s
domContentLoaded 722ms 35ms 699ms 986ms 751ms 986ms
firstPaint 75ms 11ms 56ms 164ms 84ms 164ms
firstContentfulPaint 75ms 11ms 56ms 164ms 84ms 164ms
largestContentfulPaint 0ms 0ms 0ms 0ms 0ms 0ms
Bundle size diffs [🚨 Warning! Bundle size has increased!]
  • background: 301.45 KiB (7.52%)
  • ui: -183.42 KiB (-2.21%)
  • common: 195.67 KiB (1.8%)

Copy link
Member

@chaitanyapotti chaitanyapotti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@chaitanyapotti chaitanyapotti added this pull request to the merge queue Feb 13, 2026
Merged via the queue into main with commit 65f8e66 Feb 13, 2026
176 checks passed
@chaitanyapotti chaitanyapotti deleted the fix/access-token-not-persisted branch February 13, 2026 09:08
@github-actions github-actions bot locked and limited conversation to collaborators Feb 13, 2026
@metamaskbot metamaskbot added the release-13.20.0 Issue or pull request that will be included in release 13.20.0 label Feb 13, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

release-13.20.0 Issue or pull request that will be included in release 13.20.0 size-L team-onboarding Onboarding team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Error: Failed to get marketing opt in status

4 participants