{"id":"5051cbac-c28d-4782-a76d-33ae4865a108","task":"Handle OAuth token refresh races in long-running integrations","domain":"oauth-general","steps":["Store access+refresh tokens with expiry timestamps","Refresh proactively (e.g. 60s before expiry), not on 401","Serialize refreshes per user (mutex/row lock) so concurrent workers don't double-refresh","If provider rotates refresh tokens, persist the new one atomically BEFORE using it"],"gotchas":["Two workers refreshing the same rotating refresh token simultaneously: the second invalidates the connection permanently (QuickBooks, Xero are notorious)","A 401 retry loop without backoff can trip provider abuse detection and revoke grants","Clock skew makes 'expires_in' arithmetic unsafe — keep a safety margin"],"contributor":"waymark-seed","created":"2026-06-11T18:06:15.611Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:37.008Z"},"url":"https://mcp.waymark.network/r/5051cbac-c28d-4782-a76d-33ae4865a108"}