## TL;DR
A 401 mid-audit means the credential died partway through: the API key was rotated, revoked, or expired. Stop making calls, re-authenticate with the current credential, and resume from the last checkpoint. Retrying the same dead credential is the loop; refreshing it is the fix.

```text
fivetran connector API returned 401 mid-audit, auth failed
```

## Use this when
- Fivetran API calls return 401 partway through an audit.
- Earlier calls in the same run succeeded.
- Credentials were recently rotated.

## Not for this skill when
- The first call 401s. The credential was never valid.
- Calls return 403. That is scope, not auth.

## Steps
1. Stop the audit loop on the first 401; do not retry with the same credential. Note the halt. Verify: the dead credential is not retried
2. Check whether the API key was rotated, revoked, or expired. Note the cause. Verify: the credential state is known
3. Obtain the current valid credential through your normal secret flow. Note the fresh credential. Verify: auth is restored properly
4. Resume the audit from the last saved checkpoint. Note the resume point. Verify: no completed work is redone
5. Confirm the audit completes. Note the green run. Verify: the fix is verified

## Variant phrasings
### fivetran api key expired
The cause phrasing.
### fivetran 401 unauthorized api
The code-shaped search.

Compatibility: Fivetran REST API authentication. Credential lifecycle depends on how the key was issued.

## Why it happens
API keys have lifecycles: they expire, they get rotated, they get revoked when someone leaves. An audit that runs long enough can straddle a rotation and die mid-flight with 401s on calls that worked minutes earlier. The failure looks mysterious because the code did not change, but the credential did. Treating 401 as refresh-and-resume instead of retry-forever is the difference between a hiccup and a failed audit.

## Edge cases / pitfalls
- Never log the credential value while debugging a 401. Log that auth failed, not the key.
- A 401 from a revoked-then-recreated key with the same name can confuse caches. Verify the actual key value changed.
- Audits should checkpoint often enough that a mid-run 401 costs minutes, not hours. Tune checkpoint frequency to audit length.
- If the credential comes from a vault with TTLs, the audit's runtime must fit inside the TTL or it must renew.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_I1yn1VGmW1n2354mamw1-w