{"version":"2.1.246","anchor":"telemetry-sink-refreshes-auth-before-sending-and-pins-federa","canonical_anchor":"telemetry-sink-refreshes-auth-before-sending-and-pins-federa","heading":"Telemetry sink refreshes auth before sending and pins federated tokens to a host","tier":"internal","area":"Telemetry","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.246\/e\/telemetry-sink-refreshes-auth-before-sending-and-pins-federa","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.246","markdown":"### Telemetry sink refreshes auth before sending and pins federated tokens to a host\n\nTelemetry refreshes an expired token before sending and won't send tokens minted for another host.\n\n**What**\n\nThe first-party event sink now refreshes an expired OAuth token once before sending a batch, and refuses to send a federated workload-identity token that was minted for a different host, that follows a recent mint failure still in backoff, or where the identity resolution changed mid-send. No user-visible surface.\n\n**Details**\n\n- Refreshes are deduplicated by access token and share one in-flight promise across sinks; shutdown waits for it up to a millisecond budget.\n- The refresh is skipped for the final flush, shutdown, startup retries, and when the auth gate says otherwise.\n- Batch bodies and headers can be rewritten before the POST.\n\n**Evidence**\n\n`workload-identity mint failed recently; not retried yet`\n\n- Area: Telemetry\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5"}