## TL;DR
The Duo integration key expired and every API call now 401s. Rotate the integration key in the Duo admin panel, update the agent's stored credential, and add a preflight auth check so expiry is caught before a run.

## The query
```text
agent's duo admin api call failed with 401: integration key expired mid-run
```

## Use this when
- Duo Admin API returns 401 mid-run
- the integration worked until a date
- multiple Duo operations fail at once

## Not for
- Duo push failures for users
- Duo MFA enrollment problems
- user lockouts in Duo

## Steps
1. Confirm the 401 is key expiry, not a wrong hostname or integration key name. Expected output: the failing credential is identified.
2. Generate a new integration key in the Duo Admin Panel for the integration. Expected output: a fresh key pair exists.
3. Update the agent's stored credential and restart or reload its config. Expected output: the agent picks up the new key.
4. Add a preflight check that validates the key before long runs. Expected output: expiry is detected before work starts.
5. Calendar the next rotation so it never surprises a run again. Expected output: rotation is a planned event.

## Applies to
Duo Admin API, Duo integrations, helpdesk automation agents.

## Variant phrasings
### 401 immediately after creating the key
The key was not saved in the agent config; verify the stored value.

### Intermittent 401s
Two agent instances with different keys, one revoked; consolidate to one credential.

## Why it happens
Integration keys expire on a schedule and agents cache them. The first sign of expiry is always a failed run, unless a preflight check runs first.

## Edge cases
- Duo allows multiple integration keys; rotate by adding the new one before removing the old.
- Never commit integration keys to source control.
- Monitor Duo admin logs for auth failures as an early warning.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_awrguihWzS6s_R7MmtRmQg