## TL;DR
Long ticket resolutions outlive the SSO token. Refresh the token proactively before expiry, persist the task state, and resume cleanly if a refresh fails instead of dying mid-ticket.

## The query
```text
agent's sso token expired mid-ticket-resolution: re-auth flow
```

## Use this when
- agent tasks fail halfway with token expired
- resolutions taking over an hour die reliably
- the agent loses ticket context on re-auth

## Not for
- login failures at session start
- API permission errors with a valid token
- refresh token revocation by policy

## Steps
1. Measure the token lifetime and the typical task duration to confirm expiry mid-task. Expected output: the overlap is confirmed.
2. Add a proactive refresh when the token is within a safety margin of expiry, such as five minutes. Expected output: tokens refresh before they die.
3. Persist the ticket state, including gathered facts and pending actions, before each refresh. Expected output: state survives a refresh cycle.
4. If refresh fails, park the ticket with its state and notify rather than continuing unauthenticated. Expected output: the ticket waits safely instead of failing.
5. On the next run, resume from the persisted state with the fresh token. Expected output: the task completes without redoing work.

## Applies to
Helpdesk agents using OAuth/OIDC SSO tokens, Okta, Entra ID, long-running ticket automation.

## Variant phrasings
### Token expires during a user-facing chat
Warn the user before refresh; a silent pause is better than a dead chat.

### Refresh token also expires
Fall back to a service identity for background steps and ask the user to re-auth only for user-scoped actions.

## Why it happens
SSO tokens are short-lived by design, but ticket work is long. Agents that assume the token lasts the whole task learn otherwise at the worst moment.

## Edge cases
- Never log token values; log expiry timestamps instead.
- Conditional access may block silent refresh on a changed network; handle the interactive fallback.
- Test with artificially short token lifetimes in staging.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_XAiAQbs040kSNEomy9-fCg