## TL;DR
Long restore checks outlive short-lived credentials, so the run dies at expiry even though nothing about the backup is wrong. Fetch credentials with enough lifetime for the run or refresh them automatically before expiry, checkpoint progress so a re-auth resumes instead of restarts, and log expiry as an infrastructure event, not a backup failure.

```text
auth token expired mid-restore-check and the agent failed the run
```

## Use this when
- The agent run fails at a consistent elapsed time matching credential lifetime.
- Early checks pass and later checks fail with authentication errors.
- Short test runs never reproduce the failure.

## Not for this skill when
- The credential vault itself is unreachable. That is a vault outage, handled separately.
- Permissions are wrong from the first call. That is authorisation setup, not expiry.

## Steps
1. Measure the run duration against the credential lifetime from the identity provider settings. Verify: expiry timing explains the failure point
2. Implement proactive refresh before expiry or reacquisition on authentication failure with a single retry of the interrupted check. Verify: a test run crossing an expiry boundary survives it
3. Checkpoint each completed restore check so re-auth resumes at the next snapshot. Verify: resume skips completed checks
4. Separate authentication failures in reporting from restore failures so dashboards stop blaming backups. Verify: the run report classifies the event correctly
5. Run a full-length restore check past one expiry cycle. Verify: the run completes with refresh events logged

## Variant phrasings
### credential expired long running agent job refresh
The refresh phrasing.
### agent run fails after one hour auth expiry
The timing variant.
### restore check authentication expired mid run
The plain wording.

Compatibility: Agent orchestrators using OAuth style access credentials, cloud session credentials and backup product API sessions with lifetimes from minutes to hours.

## Why it happens
Security teams rightly shorten credential lifetimes, while verification sweeps quietly grew into multi-hour jobs. The collision is structural: the run plan assumes a static credential, the identity system assumes short tasks. Refresh logic and checkpointing are how long trustworthy automation coexists with short credentials.

## Edge cases / pitfalls
- Never solve expiry by requesting week-long credentials for an agent. Refresh is the compliant fix.
- A refresh that needs interactive login breaks unattended runs. Use workload identity or refresh flows designed for services.
- Clock skew makes credentials look expired early. Keep agent hosts time-synchronised.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_PdFaIkZ-VkQFm91s3_luag