Dr. Pranay Jha

Step 3: Refresh before it dies, not after

The refresh token buys you 24 hours of renewals without ever re-sending the password. The pattern I ship has two layers. A timer refreshes the access token well inside the 60-minute window, so steady-state work never hits an expiry. A 401 handler catches the case where the timer was wrong, the clock skewed, or the job paused, refreshes once, and retries. If the refresh token itself has expired, fall back to a full re-auth.

The refresh-on-401 pattern

Here is the small session wrapper I actually use in Python. It authenticates once, retries a single time on a 401 after refreshing, and re-authenticates only if the refresh token is also dead. Forty lines that turn the most common pipeline failure into a non-event.

import requests

BASE = "https://sddc-manager.lab.local"
requests.packages.urllib3.disable_warnings()

class VcfSession:
    def __init__(self, user, password):
        self.user, self.password = user, password
        self._auth()

    def _auth(self):
        r = requests.post(f"{BASE}/v1/tokens", verify=False,
            json={"username": self.user, "password": self.password})
        r.raise_for_status()
        t = r.json()
        self.access, self.refresh = t["accessToken"], t["refreshToken"]

    def _renew(self):
        try:
            r = requests.patch(f"{BASE}/v1/tokens/access-token/refresh",
                verify=False, json={"refreshToken": self.refresh})
            r.raise_for_status()
            self.access = r.json()["accessToken"]
        except requests.HTTPError:
            self._auth()          # refresh token also expired: start over

    def get(self, path):
        h = {"Authorization": f"Bearer {self.access}"}
        r = requests.get(f"{BASE}{path}", headers=h, verify=False)
        if r.status_code == 401:  # token died mid-run
            self._renew()
            h = {"Authorization": f"Bearer {self.access}"}
            r = requests.get(f"{BASE}{path}", headers=h, verify=False)
        r.raise_for_status()
        return r.json()

# usage
s = VcfSession("svc-automation@vsphere.local", "********")
print([d["name"] for d in s.get("/v1/domains")["elements"]])

Step 4: Stop using your own login

Automation that runs as a named human is a liability. When that person leaves, rotates their password, or has their account locked, every pipeline they touched dies with no warning. Create a dedicated service account through the Users API (POST /v1/users) and give it exactly the role it needs. SDDC Manager has three.

What I tell clients: pick the role from the verbs your automation uses, not from convenience. If a job only reads, it gets VIEWER, and a leaked VIEWER token cannot change a thing. The moment you grant ADMIN to a reporting script because it was easier, you have created a credential that can rotate every password in the platform, sitting in a CI variable.

Step 5: Least privilege and clean teardown

Two habits separate automation that is safe from automation that merely works. First, pull secrets at runtime from a vault or the pipeline’s secret store, never from a file in the repo. A password in plaintext in a playbook is the breach waiting to be reported. Second, invalidate the refresh token when the job is done with DELETE /v1/tokens/refresh-token, so a 24-hour skeleton key does not outlive the five-minute job that created it.

Common auth failures and the fix

Most VCF authentication problems surface as one of a handful of HTTP status codes. The fastest way to debug is to map the symptom to the cause instead of guessing, because the fix is usually one of two things: the token is too old, or the role is too low. Here is the table I keep in my head.

The pattern across all of these is simple once you see it. A 401 is almost always about token age. A 403 is almost always about role. Internalise that split and you stop reaching for a password reset every time the API returns an error code, which saves the half hour you would otherwise spend chasing the wrong problem. The other quiet win is logging: log the status code and the request path on failure, never the token itself, so a stack trace in CI does not become a credential leak.

The Bottom Line

Treat authentication as a subsystem, not a line of setup. My recommendation: run every automation under a dedicated service account, default it to OPERATOR and drop to VIEWER for read-only jobs, and reserve ADMIN for the specific automations that rotate secrets or manage users. Refresh the access token preemptively and also handle the 401, so a long job never dies on expiry. Pull secrets from a vault, and invalidate refresh tokens on teardown. Do that once, wrap it in a small session class like the one above, and you never think about the 401 again. Skip it, and you will meet it at minute 61 of your most important pipeline.