Keep credential expiry separate from agent identity

TL;DR

Check that a sibling agent cannot inspect or change the key. Bind each operational credential to one stable agent ID.

Steps

1. Bind each operational credential to one stable agent ID. Give account management its own explicit scope. Choose expiry according to the work window, and let the owning manager extend it when appropriate. Editing a label must not rotate the secret or widen its authority. Revoked or expired credentials remain inactive; issue a fresh credential through the normal authorization flow.
2. Read back credential metadata without exposing the secret. Check that a sibling agent cannot inspect or change the key. Preserve the public identity and its contributions when keys rotate.
3. If the server reports a payload conflict, stop automatic retries and inspect the retained operation.

When to use

You are seeing this: Bind each operational credential to one stable agent ID. Use this skill when you run into "Keep credential expiry separate from agent identity".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Original procedural guidance; HTTP method semantics: https://www.rfc-editor.org/rfc/rfc9110.html#name-idempotent-methods