feat(clerk-js): Send force_origin on skipCache token requests

[nikosdouvlis]

Why

When Session Minter is active, getToken({ skipCache: true }) could be routed to the edge minter instead of origin. The skipCache contract is "give me a token minted from authoritative DB data", so we need to tell the FAPI Proxy to bypass Session Minter.

What

Send force_origin=true in the query string when skipCache: true. The FAPI Proxy will use this to route directly to origin once Session Minter is enabled.

The param is currently ignored by the backend and will be wired up in PLAT-2472.

Test plan

• Verify force_origin=true in query string when skipCache: true
• Verify force_origin absent when skipCache: false
• Existing skipCache flows still work

Summary by CodeRabbit

• Bug Fixes

  • Token refresh routing improved: when bypassing token cache with Session Minter enabled, token requests are routed to the origin to ensure reliable validation and refresh.

• Tests

  • Added integration and unit tests verifying token refresh behavior with and without Session Minter.

• Chores

  • Release notes/changeset added to document the patch.

[changeset-bot]

🦋 Changeset detected

Latest commit: ea801e3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Mar 24, 2026 9:14am

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8106

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8106

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8106

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8106

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8106

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8106

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8106

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8106

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8106

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8106

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8106

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8106

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8106

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8106

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8106

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8106

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8106

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8106

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8106

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8106

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8106

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8106

commit: ea801e3

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 55c6d3a9-41ad-42bb-bef9-8451dca8f284

📥 Commits

Reviewing files that changed from the base of the PR and between c755759 and ea801e3.

📒 Files selected for processing (1)

• integration/tests/resiliency.test.ts

---

📝 Walkthrough

Walkthrough

A changeset for @clerk/clerk-js with a patch bump was added. The Session token resolver now includes forceOrigin: 'true' in request parameters when sessionMinter is enabled and skipCache is true, causing /tokens POST bodies to contain force_origin=true. Token.create handling was adjusted to send the parameter in the request body. Playwright and unit tests were added/updated to assert force_origin is present when skipCache and sessionMinter are true, and absent when either condition is false.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main feature: sending force_origin parameter on token requests when skipCache is used, which aligns with the core changes across Session.ts, tests, and the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@integration/tests/resiliency.test.ts`:
- Around line 561-564: The test currently asserts lastBody.get('force_origin')
unconditionally, which fails when sessionMinter is off; update the assertion to
first check the sessionMinter feature flag/state used in the test harness
(sessionMinter) and only assert that lastBody.get('force_origin') === 'true'
when sessionMinter is enabled, otherwise assert that force_origin is
absent/undefined (or not set) for the POST body; locate the assertion around the
expect(lastBody.get('force_origin')).toBe('true') and guard it with a
conditional based on the sessionMinter flag used by the test setup.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 17eb570d-456d-407f-82d1-037facb48e5c

📥 Commits

Reviewing files that changed from the base of the PR and between 3efdd2c and c755759.

📒 Files selected for processing (5)

• .changeset/session-minter-force-origin.md
• integration/tests/resiliency.test.ts
• packages/clerk-js/src/core/resources/Session.ts
• packages/clerk-js/src/core/resources/__tests__/Session.test.ts
• packages/clerk-js/src/core/resources/__tests__/Token.test.ts