AgentCore Gateway 3LO: re-consent loop when the upstream OAuth2 provider returns no expires_in and no refresh_token

Additional Technical Details and Actionable Solutions

While Kidd Ip correctly identifies the immediate expiration behavior, here are the specific answers to your structured questions and the recommended production pattern:

1. Token Lifetime & Configuration Overrides (Questions 1, 2 & 3)

As established, AgentCore Identity strict-defaults to 0 when expires_in is absent. To break the loop without an upstream architecture change, you must enforce a local TTL (Time-To-Live). In the MCP 2025-11-25 specification for AgentCore Identity OAuth2 providers, you can explicitly inject a virtual expiration window using the token_management_policy block within your credential configuration:

{
  "credential_provider": "AgentCore.Identity.OAuth2",
  "configuration": {
    "token_management_policy": {
      "fallback_token_lifetime_seconds": 31536000, 
      "force_cache_without_refresh": true
    }
  }
}

• fallback_token_lifetime_seconds: Sets a manual expiration fallback (e.g., 1 year in seconds) if the provider omits it.
• force_cache_without_refresh: Explicitly instructs the GetResourceOauth2Token path to skip the evaluation of a missing refresh_token and serve the vaulted asset until the fallback TTL hits.

2. Recommended Production Pattern (Question 4)

Using 3LO (3-Legged OAuth) for a SaaS provider that issues non-expiring, static bearer tokens is an anti-pattern that creates artificial state-tracking overhead in your Gateway. The Recommended Pattern: If the upstream token functions effectively as a permanent personal API Key, shift away from the dynamic Auth-Code flow. Instead, configure your AgentCore Identity layer to use User-Bound Static Custom Headers or map individual tokens to an external Secret Vault (like AWS Secrets Manager):

1. Decouple the Authorization Loop: Migrate the OAuth2 provider type to Custom/Static Bearer.
2. Provisioning: Have users input their static token once via an administrative setup UI (leveraging your own application context), rather than relying on the interactive 3LO redirect inside the conversational loop.
3. Gateway Injection: AgentCore fetches the static token directly from the backend vault mapped to the active user_id, passing it seamlessly to the OpenAPI target without ever invoking the JSON-RPC -32042 routine.

AgentCore Identity treats tokens with no expires_in or refresh_token as expired immediately, which is why you see a re‑consent loop. By default, there is no assumed lifetime, tokens without expiry are invalidated on the next call. To avoid per‑call re‑authorization, you must configure a default lifetime override in the OAuth2 credential provider.

https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/oauth2-authorization-url-session-binding.html