NousPortalAdapter._get_credential resolves credentials while holding self._lock, which every proxied request queues on. With the challenge gate on, a 428 parked that lock (and a default-executor worker per queued request) for up to 120 s. Resolve as a background caller: the challenge is recorded/announced and the retryable error returns at once.