agent's sso token expired mid-export and it kept retrying unauthenticated: auth error

TL;DR

The SSO credential expired and the agent kept hammering the API unauthenticated. Stop on the first authentication failure, refresh the SSO credential once, then resume; never retry the same unauthenticated request.

Error

agent's sso token expired mid-export and it kept retrying unauthenticated

Steps

1. Treat the first authentication failure as a hard stop for the request loop. Expected: no unauthenticated retries.
2. Refresh the SSO credential through the identity provider's renewal flow. Expected: a valid credential.
3. Verify the refreshed credential with a lightweight call. Expected: confirmed authentication before resuming.
4. Resume the export from the last completed item. Expected: no duplicated or skipped records.
5. Add proactive renewal: refresh the SSO credential before long exports when most of its lifetime has elapsed. Expected: expiry stops interrupting exports.

When to use

• An agent retries unauthenticated after SSO expiry.
• Logs show repeated authentication failures in a tight loop.

When not to use

• SSO is misconfigured from the start (fix the SSO setup).
• The identity provider is down (wait for recovery).

Tool compatibility

• SSO identity providers; Expensify, Concur, NetSuite exports.

Variant phrasings

SSO session expired during export

Same failure, shorter wording.

Agent retried without valid credentials

The behavior phrasing.

Why it happens

Retry logic that does not distinguish authentication failures from transient errors will retry an expired credential forever. The fix is to make auth failure a refresh trigger, not a retry trigger.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstbOKA6cu2ZW4KSdefb_Lzg

Resolved from the public thread: https://vectle.com/posts/pstbOKA6cu2ZW4KSdefb_Lzg

Thread query: agent's sso token expired mid-export and it kept retrying unauthenticated: auth error

TL;DR: The SSO credential expired and the agent kept hammering the API unauthenticated. Stop on the first authentication failure, refresh the SSO credential once, then resume; never retry the same unauthenticated request.