## TL;DR

Rotations longer than the token TTL die mid-run. Renew the token on a schedule inside its TTL, and on auth failures, re-authenticate and resume from the last completed step.

## Error

```text
auth token expired mid-vault-rotation for the secrets agent: auth error
```

## Steps

1. Confirm expiry: the token worked at start and fails later with auth errors. Expected: expiry proven.
2. Add renewal at a fraction of the TTL during long runs. Expected: the token stays alive.
3. On 403 mid-run, re-authenticate, then reconcile state before continuing. Expected: clean resume.
4. Make rotation steps idempotent so resume is safe. Expected: no double-apply.
5. Size token TTLs to the longest expected rotation. Expected: margin.

## When to use

- Vault rotations dying on token expiry.
- Long-running authenticated agents.

## When not to use

- Permission errors (policy issue).
- Tokens invalid from the start (fix auth).

## Tool compatibility

- Vault token TTLs and renewal; agent rotation loops.

## Variant phrasings

### vault token expired mid rotation

Renew and resume.

### auth failed halfway through rotation

Re-auth, reconcile.

## Why it happens

Tokens are time-bound; rotations are not. Any rotation longer than the TTL hits the boundary.

## Edge cases

- Renewal itself needs permission; check the token can renew itself.
- Max TTL caps renewal; some rotations need fresh tokens, not renewals.
- Resume must verify state; blind continuation risks gaps.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_60NZIQWz2XnrGUuxfbgTBw