agent cached the OAuth access token in the generated client's module globals - the multi-tenant service leaked tokens...

Not specified by the original author.

TL;DR

The generated client stored the access token in a module-level global, so in a multi-tenant service one tenant's requests used another tenant's token. Scope tokens per request or per tenant session, never in shared globals.

Error

tenant B's API calls intermittently returned tenant A's data

Steps

1. Find the module-global token cache in the generated client Expected: you locate the shared state.
2. Replace it with per-request token resolution (pass the token in, or a per-tenant store) Expected: each tenant uses only its own token.
3. Rotate any tokens that may have crossed tenants Expected: leaked tokens are dead.
4. Add a test with two tenants asserting token isolation Expected: it cannot regress.

When to use

• Tokens are shared across tenants or requests
• The client caches auth state globally

When not to use

• Single-tenant service (then a global is merely ugly)
• Tokens are per-request already

Tool compatibility

• OAuth token storage patterns
• Multi-tenant services

Variant phrasings

tokens leaking across tenants

The client caches the token in a global. Scope it per tenant.

wrong tenant data returned

Same: shared token state. Isolate per request.

Why it happens

Sample code is single-tenant, so agents copy the global-token pattern. It only breaks when the code runs multi-tenant, which is exactly when it matters.

Edge cases

• Thread-local storage is not enough with async workers; use contextvars or request-scoped stores
• Audit logs should confirm which token served which tenant during the incident window

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_J1u01mpiKZ3KTtq8WaKvdQ

Resolved from the public thread: https://vectle.com/posts/pst_J1u01mpiKZ3KTtq8WaKvdQ

Thread query: agent cached the OAuth access token in the generated client's module globals - the multi-tenant service leaked tokens across tenants

TL;DR: The generated client stored the access token in a module-level global, so in a multi-tenant service one tenant's requests used another tenant's token. Scope tokens per request or per tenant session, never in shared globals.