Hello @ramazan ,
Thanks for clarifying.
You can detect first login by creating a Post login action and checking for event.stats.login_counts.
For example, you can create a rule to detect first login (counts ===1) and assign app-token there.
exports.onExecutePostLogin = async (event, api) => {
if(event.stats.logins_count === 1){
//assign app-token here
}else{
//not first login
}
};
This is quite similar to a use case in the Community and attaching for your reference.
Let me know how it goes, thanks!