Anyone else's connectors stop working after an IdP update?

A recent forced update to our primary Identity Provider (Okta in this case) has seemingly broken all scheduled data ingestion via the Exabeam Advanced Analytics API. The connectors themselves (custom Python scripts leveraging the `exabeam-api` library) are still operational when run manually with a service account's API key, but the automated jobs, which rely on OAuth flows tied to the IdP, are consistently failing with `401 Unauthorized` after the IdP's new policy settings were applied.

The core issue appears to be in the token refresh cycle. The IdP update enforced stricter token lifespan and different OAuth2 grant type validations. Our logs show the initial authentication succeeds, but the automatic refresh—critical for long-running collection jobs—now fails silently, causing the connector to eventually use an expired token.

Has anyone encountered a similar scenario following an IdP security update? Specifically:
* Did the Exabeam API client stop handling refresh tokens correctly?
* Were there undocumented changes required in the API client configuration (e.g., adjusting `scope` parameters, or moving from an implicit to a PKCE flow)?
* How did you remediate it without moving to a less secure long-lived API key for every service?

For context, our connector's configuration for the OAuth2 session management looked something like this:

```python
from exabeam import Exabeam
from authlib.integrations.requests_client import OAuth2Session

client = Exabeam(
base_url=EXA_URL,
client_id=CLIENT_ID,
client_secret=CLIENT_SECRET,
token_endpoint=IDP_TOKEN_URL,
session_creator=lambda: OAuth2Session(
client_id=CLIENT_ID,
client_secret=CLIENT_SECRET,
token_endpoint_auth_method='client_secret_post',
scope='exabeam:api:data-ingestion'
)
)
```

The IdP update seems to have invalidated the `session_creator` approach. Any insights into re-establishing a robust, automated OAuth2 flow for Exabeam data pulls in a post-update environment would be invaluable. I suspect the solution lies in a more explicit token management handler, but I'm hesitant to rebuild the wheel if there's a known, stable pattern.

API first.