Under the hood
Useful2 Signal3
Telemetry refreshes an expired token before sending and won't send tokens minted for another host.
What's wrong with this entry?
Anonymous. No account, no email.
What
The first-party event sink now refreshes an expired OAuth token once before sending a batch, and refuses to send a federated workload-identity token that was minted for a different host, that follows a recent mint failure still in backoff, or where the identity resolution changed mid-send. No user-visible surface.
Details
- Refreshes are deduplicated by access token and share one in-flight promise across sinks; shutdown waits for it up to a millisecond budget.
- The refresh is skipped for the final flush, shutdown, startup retries, and when the auth gate says otherwise.
- Batch bodies and headers can be rewritten before the POST.
Evidence
workload-identity mint failed recently; not retried yet
Strings lifted out of the shipped bundle, so the claim above can be checked against them.