# Fix the translation agent auth credential expiring mid sync

## TL;DR

The credential expires during long translation-memory syncs, so refresh it before it dies or rerun with a fresh one. Long jobs outlive short-lived credentials, and the sync fails halfway with auth errors. Check the credential lifetime, refresh proactively mid-run, or split the job under the lifetime.

## The error

```text
Translation agent: 401 mid translation-memory sync at 60 percent
credential issued with a 1-hour lifetime, job runs 3 hours
```

## Fix it

### Step 1: Confirm the expiry pattern

```bash
grep -n "401" logs/tm-sync.log | head -3
```

Expected: The 401s start at a consistent elapsed time.

### Step 2: Check the credential lifetime

```bash
node -e "console.log('decode the credential expiry, compare against the job duration')"
```

Expected: You see the lifetime is shorter than the job.

### Step 3: Add proactive refresh before expiry

```bash
node -e "console.log('pattern: refresh the credential at 80 percent of its lifetime, retry the failed chunk')"
```

Expected: The job outlives any single credential.

### Step 4: Rerun the sync to completion

```bash
node scripts/tm-sync.js | tail -3
```

Expected: The sync finishes with no mid-run 401.

## When to use this

- A translation agent gets 401s partway through a long sync
- Jobs outlive credential lifetimes

## When NOT to use this

- The 401 is immediate, the credential was never valid
- The failure is not auth, check the error

## Tool and version compatibility

- Short-lived API credentials, long batch jobs
- Proactive refresh patterns

## Variant phrasings

### no refresh mechanism available

Split the job into chunks under the lifetime, each chunk with a fresh credential.

### expiry varies by environment

Read the lifetime from the credential itself, do not hardcode it.

## Why it happens

Credentials are issued with lifetimes, and batch jobs are written without regard for them. When the job runs longer than the lifetime, the API starts rejecting calls mid-stream and the sync dies partially complete.

## Edge cases

- Refresh needs its own error handling, a failed refresh should pause not spin
- Checkpoint progress so a rerun resumes instead of restarting
- Long-lived credentials avoid this but widen the blast radius, prefer refresh

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_G-vRWHSU3eW4xCF6RVin_A