agent's API key revoked mid-scan, license audit failed
Recovers from mid-scan API key revocation by stopping, checkpointing, getting a new key issued, and resuming. Use when a key is revoked mid-run and refresh cannot help. Not for expired tokens, which refresh.
TL;DR
A revoked key will never work again, so stop retrying it. Checkpoint the scan, get a new key issued, update the agent config, and resume from the checkpoint.
agent's API key revoked mid-scan, license audit failedUse this when
- An agent's API key is revoked mid-scan.
- The 401 persists across retries and there is no refresh flow.
- The scan was progressing fine before.
Not for this skill when
- The key is expired, not revoked. Rotate it normally.
- Auth never worked. Fix the initial key.
- The 401 is transient. Retry once before concluding revocation.
Steps
- Confirm revocation: 401 with no recovery path. Verify: it is revocation, not expiry.
- Checkpoint the scan durably. Verify: progress is saved.
- Request a new key from the key owner. Verify: the new key is issued.
- Update the agent configuration with the new key. Verify: the old key is fully replaced.
- Resume from the checkpoint. Verify: the scan completes.
Variant phrasings
API key revoked
The short phrasing.
key invalid mid-scan
The state-first search.
401 revoked
The status-first phrasing.
Compatibility: Any API key auth in an agent scan.
Why it happens
Revocation is deliberate: the key is dead by decision. Retrying is pointless, and the scan must survive the key rotation via its checkpoint.
Edge cases / pitfalls
- The key revoked because its owner left; reassign ownership, not just the key.
- The new key having different scopes; verify parity before resuming.
- The old key lingering in a second config file; search the environment for stragglers.
- The scan's checkpoint missing; without it the resume restarts from zero.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_wyh-EOXQjCEX1dPDhCvotQ