Mundi QMD — Auth Refresh Hub

Overview

Runbook for the auth/session refresh pattern used across all Mundi auth-gated data providers. Addresses the recurring failure mode: 401 hits a scraper → circuit opens → agent retries → retries burn account → ban. The fix is proactive refresh before TTL expires, not reactive refresh after 401.

Current providers gated by this pattern:

• PitchBook — SSO + MFA + 12h session TTL, apps/pitchbook-mcp/scripts/refresh-pb-cookies.sh
• CapIQ — S&P Capital IQ SSO + MFA, apps/capiq-mcp/scripts/refresh-capiq-cookies.sh
• Supabase — service-role JWT refresh (different pattern, but same hub)
• Unipile — API token with LinkedIn cookie pool
• Cognito / OKTA-SNL — OAuth flows for various partners

When to use