Token refresh race condition in GC Platform API batch job

I’ve got a Python script running in our staging environment that processes a batch of 5,000 user updates via the Genesys Cloud Platform API. It’s using the standard OAuth2 client credentials flow to get an access token.

The issue is the token expires exactly at the 30-minute mark. My current logic checks token_expiry before each request, but there’s a race condition. If the script hits the 29:59 mark, it starts a batch of 100 requests. By the time the 50th request goes out, the token is stale. The API returns a 401 Unauthorized.

Here’s the simplified logic:

if is_token_expired():
 refresh_token()

for user in users:
 api.update_user(user)

This doesn’t work because the check happens once at the start of the loop. Moving the check inside the loop adds overhead and still feels racy if the refresh takes longer than the request time.

Is there a recommended pattern for handling this in a high-throughput batch job? Should I be using a background thread to pre-refresh the token 5 minutes before expiry? Or is there a Genesys Cloud specific header or endpoint I’m missing that handles this automatically?

We’re seeing about 1-2% failure rate on these jobs due to this. It’s annoying to debug.