The agent fetched the access token once at boot and cached it forever, so rotation broke the app hours later
The agent fetched a client-credentials token once at startup, cached it for the process lifetime, and never modeled expiry. Stubbed tests passed, the deploy was clean, and an hour later calls returned 401 until a restart. A short-lived token was treated as a static key.
Read article