## TL;DR

Sweeps longer than the credential lifetime fail partway. Refresh credentials before expiry, checkpoint per unit of work, and resume with fresh credentials after a failure.

## Error

```text
cloud api credentials expired mid-sweep for the scanner agent: auth error
```

## Steps

1. Confirm expiry versus invalid: the credentials worked at start. Expected: expiry proven.
2. Refresh credentials proactively before the known expiry. Expected: no mid-sweep death.
3. Checkpoint each completed repo or unit. Expected: resume skips finished work.
4. On expiry failure, refresh and resume from the checkpoint. Expected: the sweep completes.
5. Size credential lifetimes to the sweep or split the sweep to fit. Expected: structural fix.

## When to use

- Long sweeps dying on credential expiry.
- Designing durable scan agents.

## When not to use

- Credentials invalid from the start.
- Rate limiting (different error).

## Tool compatibility

- Cloud API credentials; checkpointed sweeps.

## Variant phrasings

### credentials expired mid sweep

Refresh and resume.

### sweep died on expired creds

Same handling.

## Why it happens

Temporary credentials expire by design; sweeps that outlive them were planned without the lifetime in mind.

## Edge cases

- Refresh needs the issuing path reachable; plan for outages.
- Checkpoints must be durable, not in-memory.
- Some credentials cannot be refreshed, only re-issued; handle both.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_M5pVKp_rFO6G6YRhchm8lg