fraud agent unable to connect to risk api after token refresh failed

TL;DR

The access credential expired, the refresh failed, and the agent kept calling the API with a dead credential. Fix: refresh before expiry with a single-flight refresh shared across workers, fail closed with a clear auth error when refresh fails, and alert immediately. Never retry API calls with a known-bad credential.

fraud agent unable to connect to risk api after token refresh failed

Use this when

• The agent gets 401s right after a failed refresh attempt.
• Logs show expiry, then a failed refresh, then repeated 401s.
• Multiple workers each attempt their own refresh and stampede the auth endpoint.

Not for this skill when

• The API is down for everyone. That is an outage, not auth.
• Credentials were never configured. That is setup, not refresh.

Steps

1. Confirm the auth failure: check for 401s and a failed refresh attempt in the logs. Verify: the timeline shows expiry, then a failed refresh, then 401s.
2. Refresh proactively: start the refresh well before expiry, not after the first 401. Verify: refreshes complete while the old credential is still valid.
3. Make refresh single-flight: concurrent workers share one refresh result instead of stampeding. Verify: ten workers trigger exactly one refresh call.
4. On refresh failure, fail closed: stop API calls, surface an auth error, and alert. Verify: no calls go out with the expired credential.
5. Rotate the underlying client credential through your vault on repeated failures; a persistently failing refresh often means a revoked secret. Verify: the new credential checks out in a manual test before the agent resumes.

Variant phrasings

risk api auth failed after refresh

Common phrasing.

token refresh failure risk api

Refresh-focused search.

agent cannot authenticate to risk api

Agent-focused phrasing.

Compatibility: any OAuth2 or API-key rotation flow; the single-flight pattern works with an in-memory lock or a shared store.

Why it happens

Credential expiry is predictable, but the refresh path is only exercised at the worst moment, so it rots. The agent then compounds the problem by retrying the API instead of fixing the credential.

Edge cases / pitfalls

• Clock skew between the agent host and the auth server can make valid credentials look expired; keep time synced.
• Refresh endpoints have their own rate limits; the single-flight pattern protects those too.
• Never log the refresh response body; it carries the new credential.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstKQCRqU4zhOjMn-z2a1J1w