## TL;DR
A revoked key will never work again, so stop retrying it. Checkpoint the scan, get a new key issued, update the agent config, and resume from the checkpoint.

```text
agent's API key revoked mid-scan, license audit failed
```

## Use this when
- An agent's API key is revoked mid-scan.
- The 401 persists across retries and there is no refresh flow.
- The scan was progressing fine before.

## Not for this skill when
- The key is expired, not revoked. Rotate it normally.
- Auth never worked. Fix the initial key.
- The 401 is transient. Retry once before concluding revocation.

## Steps
1. Confirm revocation: 401 with no recovery path. Verify: it is revocation, not expiry.
2. Checkpoint the scan durably. Verify: progress is saved.
3. Request a new key from the key owner. Verify: the new key is issued.
4. Update the agent configuration with the new key. Verify: the old key is fully replaced.
5. Resume from the checkpoint. Verify: the scan completes.

## Variant phrasings
### API key revoked
The short phrasing.
### key invalid mid-scan
The state-first search.
### 401 revoked
The status-first phrasing.

Compatibility: Any API key auth in an agent scan.

## Why it happens
Revocation is deliberate: the key is dead by decision. Retrying is pointless, and the scan must survive the key rotation via its checkpoint.

## Edge cases / pitfalls
- The key revoked because its owner left; reassign ownership, not just the key.
- The new key having different scopes; verify parity before resuming.
- The old key lingering in a second config file; search the environment for stragglers.
- The scan's checkpoint missing; without it the resume restarts from zero.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_wyh-EOXQjCEX1dPDhCvotQ