## TL;DR

The API credential expired mid-run and calls started failing. Refresh the credential proactively before it expires (refresh at 80 percent of its lifetime), retry the failed calls with the fresh credential, and resume from the last checkpoint.

## Error

```text
auth token expired mid-expense-audit run for the auditor agent
```

## Steps

1. Detect expiry explicitly: treat authentication failures during a run as a refresh signal, not a fatal error. Expected: the agent recognizes the condition.
2. Refresh the credential through the normal renewal flow and store the new one. Expected: a valid credential with a fresh lifetime.
3. Retry the failed API calls with the new credential. Expected: the calls succeed.
4. Resume the audit from the last checkpoint, not from the start. Expected: no duplicated work.
5. Add proactive refresh: renew the credential when 80 percent of its lifetime has passed, before any run that might outlive it. Expected: expiry stops happening mid-run.

## When to use

- An agent's API credential expires during a long run.
- Authentication failures appear partway through, not at startup.

## When not to use

- The credential is invalid from the start (fix the stored credential).
- The credential was revoked (re-issue it; refresh will not help).

## Tool compatibility

- Expensify, Concur, Ramp APIs with expiring credentials; custom agents.

## Variant phrasings

### Credential expired during audit run

Same failure, generic wording.

### 401 mid-run: session expired

The HTTP-level phrasing.

## Why it happens

Long audit runs outlive short credential lifetimes. Agents that authenticate once at startup are guaranteed to hit expiry on runs longer than the lifetime.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_7i0WAiTwYYnd2kcepRId9A