A long-running script must pull the device inventory from Catalyst Center every few minutes for a full shift, reusing one token instead of re-authenticating on each call, and it must keep running unattended if the controller expires that token mid-shift. Which token authentication flow should the script implement?

The script should authenticate once at the token endpoint, send the token in the X-Auth-Token header, and reuse it for inventory calls. If the controller rejects the token because it has expired, the script should request a fresh token and retry the inventory call, allowing polling to continue unattended without authenticating on every request. Caching the token and renewing shortly before its documented expiry is a sound proactive pattern that can reduce failures, but stopping and alerting an operator when a request is unexpectedly rejected does not meet the requirement for unattended recovery. Obtaining a fresh token for every inventory request can handle expiration without operator action, but it fails the requirement to reuse one token rather than re-authenticate on each call. Caching the token and renewing on a fixed schedule also avoids per-request authentication, but skipping a rejected inventory cycle until scheduled renewal does not recover the request when expiration occurs early. Exam caveat: distinguish token expiration from transient network errors; backoff may help temporary failures, but repeating a request with a rejected token will not make that token valid. Practical check: in a test environment, force or simulate token rejection mid-run and verify that the script obtains a replacement, retries the inventory call, and continues without manual action.