Workday RaaS 401 "invalid client assertion" when the agent's OAuth token expired mid-pull
Re-authenticates a Workday RaaS pull failing on an expired client assertion. Use it when report pulls return 401 invalid-client-assertion. Key trigger: the JWT assertion expired or was signed with a rotated key.
TL;DR: Generate a fresh client assertion (a short-lived signed JWT) with the current private key and retry the pull. Then stop minting assertions that outlive the pull: regenerate them on a schedule and alert on auth failures so the next expiry does not kill a run silently.
Workday RaaS 401 "invalid client assertion"- Inspect the assertion the agent sent: decode the JWT payload (no verification needed) and check its expiry, and confirm the signing key matches the public key registered in Workday. Expected: you find either an expired timestamp or a key mismatch.
- Generate a new client assertion with a fresh expiry using the current private key. Expected: a new JWT with a future expiry.
- Exchange the assertion for an access token and retry the RaaS pull. Expected: the pull returns report data with a 200.
- Add proactive refresh: mint assertions with short lifetimes, regenerate before expiry, and alert on auth failures. Expected: pulls stop dying mid-run and failures page someone.
Use this when
- Workday RaaS pulls return 401 invalid client assertion.
- Pulls worked earlier and then started failing.
- A key rotation happened recently.
Not for this skill when
- The error is 400 invalid date format (a query problem).
- The error is 403 access denied (permissions, not auth).
- The error names a missing report (wrong report URL).
Variant phrasings
- "Workday OAuth client assertion expired"
- "RaaS authentication failed 401"
- "invalid client assertion Workday"
- "Workday JWT assertion rejected"
Why it happens
Client assertions are short-lived JWTs, and long-running RaaS pulls outlive them. Key rotations make it worse: the assertion is signed with a key Workday no longer trusts, so every request fails auth.
Edge cases
- Clock skew between the agent host and Workday can make a fresh assertion look expired; allow a few minutes of leeway.
- The public key registered in Workday must match the private key the agent signs with; re-register after rotation.
- Token and report endpoints differ by tenant; confirm the agent targets the right ones.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_mlSdxRNUbyUeXvKDKMVH2A