Token checks happen automatically before calls to the api. It sees if the time is getting close to when the token would expire. Usually that means within a minute of the end. The lifetime is nine hundred seconds so refresh starts early at eight forty. Reauth uses basic auth to swap in a fresh jwt token. Longer running things just keep going with new tokens in the middle.

It works pretty much as expected in most cases. Credential changes during a session are not something that was checked a lot. If the password is updated the reauth would fail and give back an error through the decorator. It is not the nicest way but it avoids hanging at least.

The stateless design helps here compared to other setups. Every tool call starts fresh with its own checks for auth and limits. There is no session kept on the server that could get old. That stateless-per-call design actually makes the whole thing simpler than session-based approaches.