@@ -2,12 +2,13 @@ import { resolve as pResolve } from 'node:path';
 import { Readable } from 'node:stream';
 import { mkdir, writeFile } from 'node:fs/promises';
 import chunk from 'lodash/chunk';
-import { configHandler, log, FsUtility } from '@contentstack/cli-utilities';
+import { log, FsUtility } from '@contentstack/cli-utilities';
 
 import type { CSAssetsAPIConfig, LinkedWorkspace } from '../types/cs-assets-api';
 import type { ExportContext } from '../types/export-types';
 import { CSAssetsExportAdapter } from './base';
-import { writeStreamToFile, getArrayFromResponse } from '../utils/export-helpers';
+import { writeStreamToFile, getArrayFromResponse, getSecuredAssetAuth, SecuredAssetAuthError } from '../utils/export-helpers';
+import type { SecuredAssetAuth } from '../utils/export-helpers';
 import { forEachChunkedJsonStore } from '../utils/chunked-json-reader';
 import { withRetry, RetryableHttpError, isRetryableStatus, parseRetryAfterMs } from '../utils/retry';
 import type { CustomPromiseHandler } from '../utils/cs-assets-api-adapter';
@@ -111,7 +112,6 @@ export default class ExportAssets extends CSAssetsExportAdapter {
     await mkdir(filesDir, { recursive: true });
 
     const securedAssets = this.exportContext.securedAssets ?? false;
-    const authtoken = securedAssets ? configHandler.get('authtoken') : null;
     log.debug(
       `Asset downloads: securedAssets=${securedAssets}, concurrency=${this.downloadAssetsBatchConcurrency}, expected=${expectedDownloads}`,
       this.exportContext.context,
@@ -120,6 +120,9 @@ export default class ExportAssets extends CSAssetsExportAdapter {
 
     let downloadOk = 0;
     let downloadFail = 0;
+    // Set when a 401 persists after a forced token refresh — from then on, skip the network
+    // entirely and abort the phase, instead of individually failing every remaining asset.
+    let authFailure: SecuredAssetAuthError | null = null;
 
     await forEachChunkedJsonStore<AssetRecord>(
       assetsDir,
@@ -154,25 +157,60 @@ export default class ExportAssets extends CSAssetsExportAdapter {
       async (records) => {
         const valid = records.filter((asset) => this.isDownloadable(asset));
         if (valid.length === 0) return;
+        const chunkAuthFailure = authFailure;
+        if (chunkAuthFailure) {
+          // Auth already failed hard — count the remaining downloadables without hitting the network.
+          for (const rec of valid) {
+            downloadFail += 1;
+            this.tick(false, `asset: ${rec.filename ?? rec.file_name ?? rec.uid ?? 'asset'}`, chunkAuthFailure.message);
+          }
+          return;
+        }
+        // Resolve per chunk so long download phases pick up proactively refreshed OAuth tokens.
+        let auth: SecuredAssetAuth = securedAssets ? await getSecuredAssetAuth() : {};
         const apiBatches = chunk(valid, this.downloadAssetsBatchConcurrency);
         const promisifyHandler: CustomPromiseHandler = async ({ index, batchIndex }) => {
           const asset = apiBatches[batchIndex][index] as AssetRecord;
           const uid = (asset.uid ?? asset._uid) as string;
           const url = asset.url as string;
           const filename = asset.filename ?? asset.file_name ?? 'asset';
           if (!url || !uid) return;
+          const knownAuthFailure = authFailure as SecuredAssetAuthError | null;
+          if (knownAuthFailure) {
+            downloadFail += 1;
+            this.tick(false, `asset: ${filename}`, knownAuthFailure.message);
+            return;
+          }
           try {
             const separator = url.includes('?') ? '&' : '?';
-            const downloadUrl = securedAssets && authtoken ? `${url}${separator}authtoken=${authtoken}` : url;
+            const doFetch = () =>
+              fetch(
+                securedAssets && auth.authtoken ? `${url}${separator}authtoken=${auth.authtoken}` : url,
+                securedAssets && auth.headers ? { headers: auth.headers } : undefined,
+              );
             // Binary GET is idempotent — retry transient failures with backoff.
             const response = await withRetry(
               async () => {
                 let resp: Response;
                 try {
-                  resp = await fetch(downloadUrl);
+                  resp = await doFetch();
                 } catch (e) {
                   throw new RetryableHttpError(`download network error: ${(e as Error)?.message ?? String(e)}`);
                 }
+                if (securedAssets && resp.status === 401) {
+                  // Token expired or was revoked mid-run — force one refresh (deduped upstream)
+                  // and refetch. A second 401 means auth is unrecoverable: abort the phase.
+                  auth = await getSecuredAssetAuth(true);
+                  try {
+                    resp = await doFetch();
+                  } catch (e) {
+                    throw new RetryableHttpError(`download network error: ${(e as Error)?.message ?? String(e)}`);
+                  }
+                  if (resp.status === 401) {
+                    authFailure = new SecuredAssetAuthError(resp.status);
+                    throw authFailure;
+                  }
+                }
                 if (!resp.ok) {
                   if (isRetryableStatus(resp.status)) {
                     throw new RetryableHttpError(`HTTP ${resp.status}`, resp.status, parseRetryAfterMs(resp.headers.get('retry-after')));
@@ -209,6 +247,16 @@ export default class ExportAssets extends CSAssetsExportAdapter {
       },
     );
 
+    const terminalAuthFailure = authFailure as SecuredAssetAuthError | null;
+    if (terminalAuthFailure) {
+      // Fail the space loudly — a "completed with errors" summary would bury the real cause.
+      log.error(
+        `Aborted asset downloads for space ${spaceUid}: ${terminalAuthFailure.message}`,
+        this.exportContext.context,
+      );
+      throw terminalAuthFailure;
+    }
+
     log.info(
       downloadFail === 0
         ? `Finished downloading ${downloadOk} asset file(s) for space ${spaceUid}`
 
@@ -1,15 +1,16 @@
 import { resolve as pResolve } from 'node:path';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { Readable } from 'node:stream';
-import { log, handleAndLogError, configHandler } from '@contentstack/cli-utilities';
+import { log, handleAndLogError } from '@contentstack/cli-utilities';
 
 import type { CsAssetsQueryExportOptions, CSAssetsAPIConfig, LinkedWorkspace } from '../types/cs-assets-api';
 import type { ExportContext } from '../types/export-types';
 import ExportAssetTypes from '../export/asset-types';
 import ExportFields from '../export/fields';
 import { CSAssetsExportAdapter } from '../export/base';
 import chunk from 'lodash/chunk';
-import { getAssetItems, writeStreamToFile } from '../utils/export-helpers';
+import { getAssetItems, writeStreamToFile, getSecuredAssetAuth, SecuredAssetAuthError } from '../utils/export-helpers';
+import type { SecuredAssetAuth } from '../utils/export-helpers';
 import { withRetry, RetryableHttpError, isRetryableStatus, parseRetryAfterMs } from '../utils/retry';
 import type { CustomPromiseHandler } from '../utils/cs-assets-api-adapter';
 
@@ -223,26 +224,64 @@ class QueryExportWorkspaceAdapter extends CSAssetsExportAdapter {
     await mkdir(filesDir, { recursive: true });
 
     const securedAssets = this.exportContext.securedAssets ?? false;
-    const authtoken = securedAssets ? configHandler.get('authtoken') : null;
+    // Set when a 401 persists after a forced token refresh — from then on, skip the network
+    // entirely and abort the phase, instead of individually failing every remaining asset.
+    let authFailure: SecuredAssetAuthError | null = null;
+    // OAuth → Authorization: Bearer header; basic auth → ?authtoken= query param.
+    // Resolved lazily once per sequential batch (handlers within a batch share one resolve), so
+    // long download runs keep picking up proactively refreshed OAuth tokens.
+    let auth: SecuredAssetAuth = {};
+    let authBatchIndex = -1;
+    let authResolve: Promise<void> = Promise.resolve();
+    const ensureAuthForBatch = (batchIndex: number): Promise<void> => {
+      if (!securedAssets) return Promise.resolve();
+      if (batchIndex !== authBatchIndex) {
+        authBatchIndex = batchIndex;
+        authResolve = getSecuredAssetAuth().then((resolved) => {
+          auth = resolved;
+        });
+      }
+      return authResolve;
+    };
 
     const apiBatches = chunk(downloadable, this.downloadAssetsBatchConcurrency);
     const promisifyHandler: CustomPromiseHandler = async ({ index, batchIndex }) => {
       const asset = apiBatches[batchIndex][index];
       const uid = String(asset.uid ?? asset._uid);
       const url = String(asset.url);
       const filename = String(asset.filename ?? asset.file_name ?? 'asset');
+      if (authFailure) return; // auth failed hard — don't hit the network for remaining assets
       try {
+        await ensureAuthForBatch(batchIndex);
         const separator = url.includes('?') ? '&' : '?';
-        const downloadUrl = securedAssets && authtoken ? `${url}${separator}authtoken=${authtoken}` : url;
+        const doFetch = () =>
+          fetch(
+            securedAssets && auth.authtoken ? `${url}${separator}authtoken=${auth.authtoken}` : url,
+            securedAssets && auth.headers ? { headers: auth.headers } : undefined,
+          );
         // Binary GET is idempotent — retry transient failures with backoff.
         const response = await withRetry(
           async () => {
             let resp: Response;
             try {
-              resp = await fetch(downloadUrl);
+              resp = await doFetch();
             } catch (e) {
               throw new RetryableHttpError(`download network error: ${(e as Error)?.message ?? String(e)}`);
             }
+            if (securedAssets && resp.status === 401) {
+              // Token expired or was revoked mid-run — force one refresh (deduped upstream)
+              // and refetch. A second 401 means auth is unrecoverable: abort the phase.
+              auth = await getSecuredAssetAuth(true);
+              try {
+                resp = await doFetch();
+              } catch (e) {
+                throw new RetryableHttpError(`download network error: ${(e as Error)?.message ?? String(e)}`);
+              }
+              if (resp.status === 401) {
+                authFailure = new SecuredAssetAuthError(resp.status);
+                throw authFailure;
+              }
+            }
             if (!resp.ok) {
               if (isRetryableStatus(resp.status)) {
                 throw new RetryableHttpError(`HTTP ${resp.status}`, resp.status, parseRetryAfterMs(resp.headers.get('retry-after')));
@@ -265,5 +304,15 @@ class QueryExportWorkspaceAdapter extends CSAssetsExportAdapter {
     };
 
     await this.makeConcurrentCall({ apiBatches, module: 'asset downloads' }, promisifyHandler);
+
+    const terminalAuthFailure = authFailure as SecuredAssetAuthError | null;
+    if (terminalAuthFailure) {
+      // Fail the space loudly — silently skipping the rest would look like a successful export.
+      log.error(
+        `Aborted asset downloads for space ${spaceUid}: ${terminalAuthFailure.message}`,
+        this.exportContext.context,
+      );
+      throw terminalAuthFailure;
+    }
   }
 }
@@ -1,4 +1,51 @@
 import { createWriteStream } from 'node:fs';
+import { authHandler, authenticationHandler, configHandler } from '@contentstack/cli-utilities';
+
+export interface SecuredAssetAuth {
+  /** OAuth: header to attach to the download fetch (value is already "Bearer <token>"). */
+  headers?: Record<string, string>;
+  /** Basic auth: token to append as ?authtoken= (existing behavior). */
+  authtoken?: string;
+}
+
+/**
+ * Terminal auth failure for secured asset downloads: the server kept rejecting the token even
+ * after a forced refresh. Download loops throw this to abort the whole phase instead of failing
+ * every remaining asset individually.
+ */
+export class SecuredAssetAuthError extends Error {
+  readonly status: number;
+
+  constructor(status: number) {
+    super(
+      `Secured asset download authentication failed (HTTP ${status}) even after refreshing credentials. ` +
+        'Please log in again (csdx auth:login) and re-run the export.',
+    );
+    this.name = 'SecuredAssetAuthError';
+    this.status = status;
+  }
+}
+
+/**
+ * Resolve auth for secured asset binary downloads.
+ * OAuth → Authorization: Bearer header (getAuthDetails handles proactive expiry refresh).
+ * Basic → authtoken query param (existing behavior).
+ *
+ * Pass `forceRefresh` after a 401: the server rejected a token that is still inside its local
+ * expiry window (revoked/invalidated), so force a refresh — concurrent callers are deduped by
+ * authHandler's in-flight refresh promise. No-op for basic auth, which cannot be refreshed.
+ */
+export async function getSecuredAssetAuth(forceRefresh = false): Promise<SecuredAssetAuth> {
+  if (forceRefresh && authenticationHandler.isOauthEnabled) {
+    await authHandler.compareOAuthExpiry(true);
+  }
+  await authenticationHandler.getAuthDetails();
+  if (authenticationHandler.isOauthEnabled) {
+    return { headers: { authorization: authenticationHandler.accessToken } };
+  }
+  const authtoken = configHandler.get('authtoken');
+  return authtoken ? { authtoken } : {};
+}
 
 export function getArrayFromResponse(data: unknown, arrayKey: string): unknown[] {
   if (Array.isArray(data)) return data;
 
@@ -5,8 +5,11 @@ export {
   getArrayFromResponse,
   getAssetItems,
   getReadableStreamFromDownloadResponse,
+  getSecuredAssetAuth,
+  SecuredAssetAuthError,
   writeStreamToFile,
 } from './export-helpers';
+export type { SecuredAssetAuth } from './export-helpers';
 export { chunkArray, runInBatches } from './concurrent-batch';
 export { withRetry, RetryableHttpError, isRetryableStatus, parseRetryAfterMs } from './retry';
 export { detectAssetManagementExportFromContentDir } from './detect-asset-management-export';
 
@@ -1,10 +1,10 @@
 import { expect } from 'chai';
 import sinon from 'sinon';
-import { configHandler } from '@contentstack/cli-utilities';
 
 import ExportAssets from '../../../src/export/assets';
 import { CSAssetsExportAdapter } from '../../../src/export/base';
 import * as chunkedJsonReader from '../../../src/utils/chunked-json-reader';
+import * as exportHelpers from '../../../src/utils/export-helpers';
 import * as retryModule from '../../../src/utils/retry';
 
 import type { CSAssetsAPIConfig, LinkedWorkspace } from '../../../src/types/cs-assets-api';
@@ -230,7 +230,7 @@ describe('ExportAssets', () => {
     });
 
     it('should append authtoken to URL when securedAssets is true', async () => {
-      sinon.stub(configHandler, 'get').returns('my-auth-token');
+      sinon.stub(exportHelpers, 'getSecuredAssetAuth').resolves({ authtoken: 'my-auth-token' });
       wireStreaming([{ uid: 'a1', url: 'https://cdn.example.com/a1.png', filename: 'img.png' }] as any);
       fetchStub.callsFake(async () => makeFetchResponse() as any);
 
@@ -241,7 +241,7 @@ describe('ExportAssets', () => {
     });
 
     it('should use "&" separator when URL already contains "?"', async () => {
-      sinon.stub(configHandler, 'get').returns('my-token');
+      sinon.stub(exportHelpers, 'getSecuredAssetAuth').resolves({ authtoken: 'my-token' });
       wireStreaming([{ uid: 'a1', url: 'https://cdn.example.com/a1?v=1', filename: 'img.png' }] as any);
       fetchStub.callsFake(async () => makeFetchResponse() as any);
 
@@ -279,4 +279,87 @@ describe('ExportAssets', () => {
       expect(assetTicks[0].args[2]).to.equal('No response body');
     });
   });
+
+  describe('secured asset downloads', () => {
+    const securedContext: ExportContext = { ...exportContext, securedAssets: true };
+    const asset = { uid: 'a1', url: 'https://cdn.example.com/a1.png', filename: 'img.png' };
+    const make401 = () => ({ ok: false, status: 401, headers: { get: (): string | null => null } });
+
+    it('should send the Authorization header (and no authtoken param) for OAuth', async () => {
+      wireStreaming([asset] as any);
+      sinon.stub(exportHelpers, 'getSecuredAssetAuth').resolves({ headers: { authorization: 'Bearer oauth-token' } });
+      fetchStub.callsFake(async () => makeFetchResponse() as any);
+
+      const exporter = new ExportAssets(apiConfig, securedContext);
+      await exporter.start(workspace, spaceDir);
+
+      const [url, init] = fetchStub.firstCall.args;
+      expect(url).to.equal(asset.url);
+      expect(init).to.deep.equal({ headers: { authorization: 'Bearer oauth-token' } });
+    });
+
+    it('should append ?authtoken= (and no headers) for basic auth', async () => {
+      wireStreaming([asset] as any);
+      sinon.stub(exportHelpers, 'getSecuredAssetAuth').resolves({ authtoken: 'basic-token' });
+      fetchStub.callsFake(async () => makeFetchResponse() as any);
+
+      const exporter = new ExportAssets(apiConfig, securedContext);
+      await exporter.start(workspace, spaceDir);
+
+      const [url, init] = fetchStub.firstCall.args;
+      expect(url).to.equal(`${asset.url}?authtoken=basic-token`);
+      expect(init).to.be.undefined;
+    });
+
+    it('should not resolve auth or attach credentials for unsecured exports', async () => {
+      wireStreaming([asset] as any);
+      const authStub = sinon.stub(exportHelpers, 'getSecuredAssetAuth');
+      fetchStub.callsFake(async () => makeFetchResponse() as any);
+
+      const exporter = new ExportAssets(apiConfig, exportContext);
+      await exporter.start(workspace, spaceDir);
+
+      expect(authStub.called).to.be.false;
+      const [url, init] = fetchStub.firstCall.args;
+      expect(url).to.equal(asset.url);
+      expect(init).to.be.undefined;
+    });
+
+    it('should force-refresh once on 401 and succeed with the fresh token', async () => {
+      wireStreaming([asset] as any);
+      const authStub = sinon
+        .stub(exportHelpers, 'getSecuredAssetAuth')
+        .callsFake(async (force?: boolean) =>
+          force ? { headers: { authorization: 'Bearer fresh' } } : { headers: { authorization: 'Bearer stale' } },
+        );
+      fetchStub.callsFake(async (_url: any, init: any) =>
+        init?.headers?.authorization === 'Bearer fresh' ? (makeFetchResponse() as any) : (make401() as any),
+      );
+
+      const exporter = new ExportAssets(apiConfig, securedContext);
+      await exporter.start(workspace, spaceDir);
+
+      expect(authStub.calledWith(true)).to.be.true;
+      expect(fetchStub.callCount).to.equal(2);
+      const tickStub = (CSAssetsExportAdapter.prototype as any).tick as sinon.SinonStub;
+      const assetTicks = tickStub.getCalls().filter((c) => String(c.args[1]).startsWith('asset:'));
+      expect(assetTicks).to.have.length(1);
+      expect(assetTicks[0].args[0]).to.be.true;
+    });
+
+    it('should abort the space with SecuredAssetAuthError when 401 persists after refresh', async () => {
+      wireStreaming(assetItems);
+      sinon.stub(exportHelpers, 'getSecuredAssetAuth').resolves({ headers: { authorization: 'Bearer bad' } });
+      fetchStub.callsFake(async () => make401() as any);
+
+      const exporter = new ExportAssets(apiConfig, securedContext);
+      try {
+        await exporter.start(workspace, spaceDir);
+        expect.fail('should have thrown');
+      } catch (e: any) {
+        expect(e).to.be.instanceOf(exportHelpers.SecuredAssetAuthError);
+        expect(e.message).to.include('401');
+      }
+    });
+  });
 });