# auth token expired mid proposal generation run and failed to refresh: how to fix it

An auth session expiring mid proposal run needs proactive refresh, not a retry of the failed call. Check expiry before the run and refresh when close to the edge, and handle mid-run expiry by refreshing and resuming. Long generation runs always outlast short-lived sessions.

```text
auth token expired mid proposal generation run and failed to refresh
```

## When to use this skill
- Proposal generation dies on expired auth mid-run
- Refresh was attempted but the run still failed

## When not to use this skill
- Auth fails at startup (an auth configuration issue)
- The session is fine but calls fail (an API issue)

## Tool compatibility
Agent runs with expiring auth sessions. Refresh flows.
Related area: auth sessions, SSO, and identity flows.
Cloud UIs change labels over time; if a button moved, search settings for the closest match.

## Before you start
- Sign in to the tool and keep one tab open so sessions stay clean
- Copy the exact error text and note the time it happened
- Set aside 15 to 20 minutes; most of these resolve in a single pass

## Quick diagnosis
Make sure this is the right skill before you invest the 15 minutes.
- If you are dealing with proposal generation dies on expired auth mid-run, start at step 1 below.
- If instead auth fails at startup (an auth configuration issue), stop here; you need a different skill.
- If neither quite matches, compare your screen against the verbatim error block at the top; that block is exactly what this skill covers.

## Fix it in steps
### 1. Check session age before the run

```
Read the session expiry at startup and refresh if under 30 minutes remain.
```
Expected: the run starts with a fresh session.

### 2. Add a refresh routine

```
Build a re-authentication step the agent can call at any point.
```
Expected: expiry becomes recoverable mid-run.

### 3. Resume after refresh

```
On expiry, refresh the session and retry the failed step from a checkpoint.
```
Expected: the run continues instead of dying.

### 4. Verify a long run

```
Test with a run longer than the session lifetime.
```
Expected: clean completion across a refresh boundary.

## Confirm each step worked
Run through this checklist before moving on. If a check fails, redo that step instead of pushing ahead.
- Step 1 (check session age before the run): Expected: the run starts with a fresh session.
- Step 2 (add a refresh routine): Expected: expiry becomes recoverable mid-run.
- Step 3 (resume after refresh): Expected: the run continues instead of dying.
- Step 4 (verify a long run): Expected: clean completion across a refresh boundary.

## Quick recap
1. Check session age before the run
2. Add a refresh routine
3. Resume after refresh
4. Verify a long run

## Still stuck?
Gather three things: the exact error text, the time it happened, and what changed just before it broke.
Check the vendor status page for an active incident. Then open a support ticket with those three things;
it cuts the back-and-forth in half. For agent runs, attach the last 50 lines of the agent log too,
since the loop or timeout signature in the log usually names the cause.

## Variant phrasings
### auth expired mid proposal run
Refresh proactively and resume from checkpoints. If this matches what you saw, the steps above apply as written.

### session expired agent failed to refresh
Build refresh as a first-class routine, not an afterthought. If this matches what you saw, the steps above apply as written.

## Why it happens
Proposal runs take longer than typical session lifetimes, so expiry mid-run is a matter of when, not if. Agents that only authenticate at startup have no recovery path when the session dies halfway.

## Edge cases
- Refresh credentials need secure storage, never hardcode them
- Some providers invalidate refresh after use, handle rotation
- Log every refresh to spot expiry patterns

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ZF3EolWpWX-r6QT7xHLfqQ