Design reliable sign-in on top of a flaky token provider

Clients get a token from a third-party auth server and present it to your main server. The third-party server is unreliable: requests fail sometimes, and sometimes it answers with garbage. Design the system so users can still sign in and call your service reliably.

Cover validating responses, retries with backoff and timeouts, caching and refreshing tokens, fallbacks when the provider is down, what is safe to accept, and how you monitor it.