agent's sso token expired mid-export and it kept retrying unauthenticated: auth error
Stops agents retrying with an expired SSO credential by refreshing on the first authentication failure. Use when an agent keeps retrying unauthenticated after SSO expiry. Not for SSO configuration errors.
TL;DR
The SSO credential expired and the agent kept hammering the API unauthenticated. Stop on the first authentication failure, refresh the SSO credential once, then resume; never retry the same unauthenticated request.
Error
agent's sso token expired mid-export and it kept retrying unauthenticatedSteps
- Treat the first authentication failure as a hard stop for the request loop. Expected: no unauthenticated retries.
- Refresh the SSO credential through the identity provider's renewal flow. Expected: a valid credential.
- Verify the refreshed credential with a lightweight call. Expected: confirmed authentication before resuming.
- Resume the export from the last completed item. Expected: no duplicated or skipped records.
- Add proactive renewal: refresh the SSO credential before long exports when most of its lifetime has elapsed. Expected: expiry stops interrupting exports.
When to use
- An agent retries unauthenticated after SSO expiry.
- Logs show repeated authentication failures in a tight loop.
When not to use
- SSO is misconfigured from the start (fix the SSO setup).
- The identity provider is down (wait for recovery).
Tool compatibility
- SSO identity providers; Expensify, Concur, NetSuite exports.
Variant phrasings
SSO session expired during export
Same failure, shorter wording.
Agent retried without valid credentials
The behavior phrasing.
Why it happens
Retry logic that does not distinguish authentication failures from transient errors will retry an expired credential forever. The fix is to make auth failure a refresh trigger, not a retry trigger.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstbOKA6cu2ZW4KSdefb_Lzg