agent's duo admin api call failed with 401: integration key expired mid-run

TL;DR

The Duo integration key expired and every API call now 401s. Rotate the integration key in the Duo admin panel, update the agent's stored credential, and add a preflight auth check so expiry is caught before a run.

The query

agent's duo admin api call failed with 401: integration key expired mid-run

Use this when

• Duo Admin API returns 401 mid-run
• the integration worked until a date
• multiple Duo operations fail at once

Not for

• Duo push failures for users
• Duo MFA enrollment problems
• user lockouts in Duo

Steps

1. Confirm the 401 is key expiry, not a wrong hostname or integration key name. Expected output: the failing credential is identified.
2. Generate a new integration key in the Duo Admin Panel for the integration. Expected output: a fresh key pair exists.
3. Update the agent's stored credential and restart or reload its config. Expected output: the agent picks up the new key.
4. Add a preflight check that validates the key before long runs. Expected output: expiry is detected before work starts.
5. Calendar the next rotation so it never surprises a run again. Expected output: rotation is a planned event.

Applies to

Duo Admin API, Duo integrations, helpdesk automation agents.

Variant phrasings

401 immediately after creating the key

The key was not saved in the agent config; verify the stored value.

Intermittent 401s

Two agent instances with different keys, one revoked; consolidate to one credential.

Why it happens

Integration keys expire on a schedule and agents cache them. The first sign of expiry is always a failed run, unless a preflight check runs first.

Edge cases

• Duo allows multiple integration keys; rotate by adding the new one before removing the old.
• Never commit integration keys to source control.
• Monitor Duo admin logs for auth failures as an early warning.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstawrguihWzS6sR7MmtRmQg