Token should not be created if a user already has a token. Following is the create method of DeviseTokenAuth

 def create
   
    field = (resource_params.keys.map(&:to_sym) & resource_class.authentication_keys).first
    
    @resource = nil
    if field
      email_value = get_case_insensitive_field_from_resource_params(field)  
      @resource = find_resource(field, email_value)  
    end
    debugger # login is done
    if @resource && valid_params?(field, email_value) && @resource.active_for_authentication?
      
      valid_password = @resource.valid_password?(resource_params[:password])
      if (@resource.respond_to?(:valid_for_authentication?) && !@resource.valid_for_authentication? { valid_password }) || !valid_password
        return render_create_error_bad_credentials
      end
      debugger
      @token = @resource.create_token
      @resource.save
      sign_in(:user, @resource, store: false, bypass: false)    
    
      yield @resource if block_given?

      render_create_success
    elsif @resource && !(@resource.active_for_authentication?)
      if @resource.respond_to?(:locked_at) && @resource.locked_at
        render_create_error_account_locked
      else
        render_create_error_not_confirmed
      end
    else
      render_create_error_bad_credentials
    end
    
  end

The issue points to DeviseTokenAuth’s create method; start by tracing @resource.create_token and @resource.save in that entry point. Check how an existing user token is represented and verify that signing in a user who already has a token does not create another token.