auth token expired mid-run while the agent downloaded 40k transactions for the close

TL;DR

A credential with a one-hour life inside a multi-hour download guarantees a mid-run expiry. The agent needs a refresh path it can use without human help: track the credential's expiry, refresh it shortly before it lapses, and if a call still fails on expiry, refresh once and resume from the last checkpointed page. Restarting the download from zero after every expiry turns a long job into an endless one as data grows.

auth token expired mid-run while the agent downloaded 40k transactions for the close

Use this when

• The download fails partway with authentication errors after running successfully for a while.
• The job's total duration exceeds the credential lifetime, here a 40k transaction pull at close.
• Restarting the job works initially, then fails again at a similar elapsed time.

Not for this skill when

• Credentials fail from the first call. That is a wrong or revoked credential, not an expiry pattern.
• The provider requires interactive re-authentication that an agent cannot perform. Then a human must re-link, and the job design should pause and ask, not loop.

Steps

1. Measure the pattern: log credential issue and expiry times and the failure time in the run. Verify: failure aligns with expiry, confirming the diagnosis
2. Implement refresh ahead of expiry: when the remaining credential life drops below a threshold, obtain the new credential before continuing the download. Verify: a test run crosses the old expiry point without an authentication failure
3. Checkpoint downloaded pages or chunks durably as the run proceeds. Verify: killing the run mid-download preserves completed chunks
4. On an authentication failure, attempt one refresh and resume from the last checkpoint; if refresh fails, stop and report rather than retrying blindly. Verify: the failure path ends in a clear report, not a retry storm
5. Run the full 40k pull and verify totals against the source counts. Verify: the completed run spans at least one credential refresh with no data gap or duplication

Variant phrasings

auth expired mid run agent long download resume

The mid-run expiry phrasing.

agent job credential refresh checkpoint download

When adding refresh and resume.

Compatibility: OAuth-style access and refresh flows for accounting, bank, and ERP APIs in long-running agent jobs.

Why it happens

Interactive sign-in design assumes a human present at the start of a short session. Agent close jobs invert both assumptions: no human, and sessions measured in hours. Providers issue short-lived access credentials precisely so that refresh, not longevity, is the security mechanism. An agent without a refresh path is therefore not unlucky but unfinished, and expiry at scale is a when, not an if.

Edge cases / pitfalls

• Store refresh capability in the platform's approved credential store, never in the job code or logs, and log only that a refresh occurred.
• Some providers rotate refresh credentials on use; persisting the newest one after each refresh is essential or the second refresh fails.
• Clock skew between the agent host and the provider can eat minutes of credential life; sync the host clock before debugging exotic expiry.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstUfcxLpLjt7xdAsGpB9mLw