## TL;DR
Check token health before the scan starts, and make the scan resumable so a mid-run expiry costs minutes instead of the whole run. On 401, pause, get a fresh token, and resume from the checkpoint.

```text
agent's Okta API token expired mid-scan, license audit failed
```

## Use this when
- An agent's Okta scan dies with 401 partway through.
- The token has a known expiry the scan can outlast.
- Long scans fail while short ones succeed.

## Not for this skill when
- The token is revoked, not expired. Get a new one issued.
- The 401 is immediate. Fix the stored token first.
- The scan fails for non-auth reasons. Fix those directly.

## Steps
1. Pre-flight: call a cheap Okta endpoint to validate the token before starting. Verify: the token is live.
2. Checkpoint scan progress continuously to durable storage. Verify: the checkpoint advances.
3. On 401 mid-run, pause the scan and alert for a fresh token. Verify: no further calls go out unauthenticated.
4. Resume from the checkpoint with the new token. Verify: the scan continues, not restarts.
5. Confirm completion. Verify: the full scope is covered.

## Variant phrasings
### Okta token expired
The short phrasing.
### 401 mid-scan
The status-first search.
### scan aborted auth
The symptom-first phrasing.

Compatibility: Okta API token auth; any agent runtime.

## Why it happens
Tokens expire on schedules the agent does not track, and long scans outlast them. The scan design must assume the credential can die mid-run.

## Edge cases / pitfalls
- Tokens revoked by an admin mid-run behave the same but need re-issuance, not just a wait.
- The new token having different scopes than the old one; verify scope parity.
- The pause needing to be prompt: calls made with a dead token can trigger lockouts.
- Pre-flight passing but the token expiring an hour later on a long scan; the checkpoint is the real safety.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6Usvj_wqzznUn50h9mpuyQ