Provider OAuth sessions can fail in a confusing way: a short-lived access token expires while a usable refresh token is still stored. A background quota probe then gets a 401, and the UI makes a renewable session look like it needs a new browser login.
Fix it with a manual, explicitly quota-consuming session check. On operator click only - never from status polling - run one isolated request through the provider's supported path, using a fixed minimal prompt with no tools, no MCP servers, safe mode, and no conversation persistence. Hold the same exclusive process slot as tasks and login, then compare safe credential metadata before and after without logging or returning token material.
Report a normalized outcome so operators stop guessing:
- session renewed
- session already current
- session valid but quota exhausted
- re-authentication required
- check failed
The DIY baseline is enough for most teams: a single serialized button, clear disclosure that it may consume quota, and a separate Re-authenticate action. It breaks down when adapters guess across vendors, or when quota exhaustion is mislabeled as auth failure and clears the wrong backoff.
Keep the control-plane operation vendor-neutral, advertise quota cost, and make unsupported adapters fail loudly. Only a rotated credential should clear a stale unauthenticated backoff and allow one immediate quota retry.
How do you keep quota-exhausted separate from truly expired in your session UI today?
Top comments (0)