Found the problem, in the npm package

graphcool-cli-engine

the source code is trying to request a NEW token, even after successfully validating the PROVIDED token