## TL;DR
The agent gets a 401, re-authenticates, gets another 401, and loops. Break it: after two consecutive failed authentications, stop the run and surface the credential problem instead of retrying.

```text
agent loop detected: re-authenticating to Okta without progress, run failed
```

## Use this when
- An agent loops on Okta authentication failures.
- Each re-auth fails the same way.
- The run burns rate limit on retries.

## Not for this skill when
- Auth fails once then succeeds. That is a transient.
- The failure is not auth. Fix the real error.
- The credential was just fixed. Re-run cleanly.

## Steps
1. Count consecutive authentication failures in the run. Verify: the counter increments.
2. After two failures, stop the run. Verify: no third attempt fires.
3. Report the failing credential and the last error. Verify: the report is specific.
4. Fix the credential: rotate, unlock, or correct the stored value. Verify: the fix addresses the error.
5. Re-run from the start. Verify: authentication succeeds.

## Variant phrasings
### re-auth loop
The short phrasing.
### 401 loop
The status-first search.
### authentication retry loop
The generic phrasing.

Compatibility: Any agent authenticating to Okta in a loop.

## Why it happens
Re-authenticating with a broken credential never succeeds. The loop just burns rate limit and delays the real fix, which is always credential repair.

## Edge cases / pitfalls
- The credential fixed mid-loop by someone else; still stop and re-run clean rather than trusting the loop state.
- Two attempts being too few for flaky networks; distinguish network flakes from auth failures.
- The report needing to name the credential, or the fix goes to the wrong place.
- Backoff between the two attempts: a brief pause avoids hammering, but the cap is what matters.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_n7rhrWDIHT6rJdEWcPrssQ