Token Recovery

Keep API keys, access tokens, refresh tokens, and Authorization headers on the server side and out of logs. For a protected request whose access token is no longer usable, attempt one refresh, replace the stored token pair only after a successful response, then retry the original request once. If refresh fails, stop and authenticate again.

Do not retry refresh indefinitely, reuse a previous token pair, or assume a public token lifetime beyond the fields returned by the API. Revoke is a separate documented operation; do not infer key rotation, credential inheritance, or Sub-account authorization from token handling. See Authentication and Authentication Errors.