Handle expired credentials without exposing them in errors

An upstream 401 is operational evidence, but its raw body or credential must not be copied to clients and broad logs.

Sanitize a fixture failure

The integration lab maps an authored upstream body.

from integration_cases import expired_credential_case

result = expired_credential_case()
assert result["client"]["code"] == "DEPENDENCY_AUTH_UNAVAILABLE"
assert result["secret_in_client"] is False
assert result["secret_in_log"] is False
assert result["refresh_attempted"] is False

Classify provider 401/403 carefully. If refresh is supported, serialize refresh to avoid a stampede, use the authorized credential store and retry the original operation once within deadline. If not, open an operational alert and fail safely.

Log dependency, request ID, status and credential reference/version, never token value. Revoke/rotate on suspected exposure. Do not retry invalid credentials indefinitely or reveal provider details to the user.

The FDE for Freshers course connects OAuth/API keys to resilient client adapters.

Exercise

Create a fake provider returning expired, forbidden and throttled responses. Assert safe client codes, bounded refresh and secret-free logs.

Continue learning

This article is part of the FDE integration and deployment foundations sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Create a backup and restore exercise for project data.
• Continue with Build a small retrieval service with cited results.

Reference: OAuth 2.0 Security Best Current Practice RFC 9700.