## TL;DR
Long authenticated scans outlive short-lived test credentials, so the agent must check credential expiry before starting, watch for auth-failure patterns mid-run, re-authenticate, and resume from a checkpoint. Never restart the whole scan from zero: checkpoint progress so a re-auth costs minutes, not hours.

```text
agent scan credentials expired mid-run; authenticated scan failed on authorized test account
```

## Use this when
- An authenticated scan starts successfully and fails partway with login or permission errors.
- The engagement uses short-lived test credentials with a known expiry.
- You run multi-hour scans under an agent's control.

## Not for this skill when
- The credentials were wrong from the start. That is a setup error; fix the credentials before launching.
- The failure is a scan tool crash, not an auth rejection. Check the error text first.
- The credentials belong to an account outside your authorized test scope. Do not use them.

## Steps
1. Before launching, read the credential's expiry (token lifetime or password rotation schedule) and compare it with the scan's estimated duration. Verify: you can state whether the scan will outlive the credential.
2. Checkpoint scan progress continuously: completed targets, completed test cases, and the last finished item go to a state file after every unit of work. Verify: killing the agent mid-run loses at most one unit of work.
3. Teach the agent the re-auth signal: a burst of 401 or 403 responses, or login-page redirects on requests that previously succeeded, means credentials expired, not that the target is down. Verify: the agent can distinguish this pattern from a target outage.
4. On the signal, pause the scan, re-authenticate with the engagement's credential procedure, and verify the new session with one probe request. Verify: the probe returns the authenticated response before resuming.
5. Resume from the checkpoint state file, not from the beginning. Verify: the resumed run skips already-completed targets.

## Variant phrasings
### authenticated scan fails halfway credentials expired
Common phrasing.
### agent re-authenticate mid scan test account
Agent-workflow phrasing.
### long scan outlives session credentials
Symptom-level search.

Compatibility: any authenticated scan tooling. The pattern is about the agent loop, not a specific scanner.

## Why it happens
Test accounts often carry short session lifetimes for safety, while scans run for hours. Agents treat the initial login as permanent and interpret the mid-run 401s as target failures, so they either loop uselessly or abort and discard hours of progress.

## Edge cases / pitfalls
- Some apps expire sessions on IP change. If the agent's egress IP rotates, re-auth may fail for a different reason; check the session binding first.
- Do not bake credential refresh into the scan tool's retry loop silently. Log every re-auth event with a timestamp for the engagement record.
- If re-auth fails twice, stop and page the tester. Repeated login attempts against the auth endpoint start to look like a brute-force probe.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6Y5eXYk8liLAFH04GHE_Mw