## TL;DR
A credential with a one-hour life inside a multi-hour download guarantees a mid-run expiry. The agent needs a refresh path it can use without human help: track the credential's expiry, refresh it shortly before it lapses, and if a call still fails on expiry, refresh once and resume from the last checkpointed page. Restarting the download from zero after every expiry turns a long job into an endless one as data grows.

```text
auth token expired mid-run while the agent downloaded 40k transactions for the close
```

## Use this when
- The download fails partway with authentication errors after running successfully for a while.
- The job's total duration exceeds the credential lifetime, here a 40k transaction pull at close.
- Restarting the job works initially, then fails again at a similar elapsed time.

## Not for this skill when
- Credentials fail from the first call. That is a wrong or revoked credential, not an expiry pattern.
- The provider requires interactive re-authentication that an agent cannot perform. Then a human must re-link, and the job design should pause and ask, not loop.

## Steps
1. Measure the pattern: log credential issue and expiry times and the failure time in the run. Verify: failure aligns with expiry, confirming the diagnosis
2. Implement refresh ahead of expiry: when the remaining credential life drops below a threshold, obtain the new credential before continuing the download. Verify: a test run crosses the old expiry point without an authentication failure
3. Checkpoint downloaded pages or chunks durably as the run proceeds. Verify: killing the run mid-download preserves completed chunks
4. On an authentication failure, attempt one refresh and resume from the last checkpoint; if refresh fails, stop and report rather than retrying blindly. Verify: the failure path ends in a clear report, not a retry storm
5. Run the full 40k pull and verify totals against the source counts. Verify: the completed run spans at least one credential refresh with no data gap or duplication

## Variant phrasings
### auth expired mid run agent long download resume
The mid-run expiry phrasing.
### agent job credential refresh checkpoint download
When adding refresh and resume.

Compatibility: OAuth-style access and refresh flows for accounting, bank, and ERP APIs in long-running agent jobs.

## Why it happens
Interactive sign-in design assumes a human present at the start of a short session. Agent close jobs invert both assumptions: no human, and sessions measured in hours. Providers issue short-lived access credentials precisely so that refresh, not longevity, is the security mechanism. An agent without a refresh path is therefore not unlucky but unfinished, and expiry at scale is a when, not an if.

## Edge cases / pitfalls
- Store refresh capability in the platform's approved credential store, never in the job code or logs, and log only that a refresh occurred.
- Some providers rotate refresh credentials on use; persisting the newest one after each refresh is essential or the second refresh fails.
- Clock skew between the agent host and the provider can eat minutes of credential life; sync the host clock before debugging exotic expiry.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_U_fcxLpLjt7xdAsGpB9mLw