auth token expired mid-engagement: agent authenticated scan of authorized app failed
Fixes agents whose authenticated scans die mid-engagement when the app's auth token expires, because the agent never refreshes it. Use when scans fail partway with token-expiry errors on an authorized app. Only for apps you are engaged to test; never reuse tokens outside the engagement.
TL;DR
App auth tokens expire on their own schedule, and an agent that logs in once will fail every request after expiry. Refresh the token proactively before it dies, keep a lifetime buffer (refresh at 80 percent of token life), and on expiry signals pause, refresh, verify with one probe, and resume from the checkpoint. Treat token handling as engagement infrastructure, not scan logic.
auth token expired mid-engagement: agent authenticated scan of authorized app failedUse this when
- An authenticated app scan fails partway with expired-token or invalid-token errors.
- The app issues tokens with a known lifetime shorter than the scan duration.
- The agent currently logs in once and never refreshes.
Not for this skill when
- Login never worked. That is a credential or flow problem, not an expiry problem.
- The scan tool itself crashed. Check for the token-expiry error text first.
- The token belongs to an app outside your authorized engagement. Do not use it.
Steps
- Learn the token lifetime from the login response or the engagement docs. Verify: you can state the lifetime in minutes.
- Schedule proactive refresh at 80 percent of the lifetime, in the background, without pausing the scan. Verify: a refresh event is logged before any expiry error appears.
- Teach the agent the expiry signal: token-expired error bodies or sudden 401s on previously working requests. Verify: the agent names token expiry as the cause instead of blaming the target.
- On the signal, pause new requests, run the refresh flow, and verify with a single authenticated probe. Verify: the probe succeeds before the scan resumes.
- Resume from the checkpoint. Verify: no target is scanned twice and none is skipped.
Variant phrasings
bearer token expires during long scan
Common phrasing.
agent refresh auth token mid engagement
Agent-workflow phrasing.
authenticated scan 401 halfway through
Symptom-level search.
Compatibility: token-based app auth generally. The 80-percent refresh rule works for any stated lifetime.
Why it happens
Tokens are issued with lifetimes tuned for human sessions, not multi-hour agent scans. The agent's plan has exactly one login step, so expiry lands as a surprise mid-run, and the error text looks like the app rejecting the scan rather than the clock running out.
Edge cases / pitfalls
- Refresh tokens expire too. Track both lifetimes; a dead refresh token needs the full login flow again.
- Clock skew between the agent host and the app server can make a "valid" token read as expired. Sync the clock before debugging the flow.
- Never log token values. Log the refresh event, the expiry timestamp, and the outcome, nothing else.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstGK_0fVsLrjCkVHtq-jb6Q