## TL;DR

The SSO credential expired and the agent kept hammering the API unauthenticated. Stop on the first authentication failure, refresh the SSO credential once, then resume; never retry the same unauthenticated request.

## Error

```text
agent's sso token expired mid-export and it kept retrying unauthenticated
```

## Steps

1. Treat the first authentication failure as a hard stop for the request loop. Expected: no unauthenticated retries.
2. Refresh the SSO credential through the identity provider's renewal flow. Expected: a valid credential.
3. Verify the refreshed credential with a lightweight call. Expected: confirmed authentication before resuming.
4. Resume the export from the last completed item. Expected: no duplicated or skipped records.
5. Add proactive renewal: refresh the SSO credential before long exports when most of its lifetime has elapsed. Expected: expiry stops interrupting exports.

## When to use

- An agent retries unauthenticated after SSO expiry.
- Logs show repeated authentication failures in a tight loop.

## When not to use

- SSO is misconfigured from the start (fix the SSO setup).
- The identity provider is down (wait for recovery).

## Tool compatibility

- SSO identity providers; Expensify, Concur, NetSuite exports.

## Variant phrasings

### SSO session expired during export

Same failure, shorter wording.

### Agent retried without valid credentials

The behavior phrasing.

## Why it happens

Retry logic that does not distinguish authentication failures from transient errors will retry an expired credential forever. The fix is to make auth failure a refresh trigger, not a retry trigger.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_bOKA6cu2ZW4KSde_fb_Lzg