Hi! OAuth token refresh is handled within the profile, and will automatically get picked up by agents using it. If you actually want to pull or rotate a credential, you can do that too and re-inject.

The pattern that's increasingly common is having a pilot or orchestrator agent sitting on top of the fleet that manages this.