Eventing implements the dynamic auth callbacks. The libcouchbase SDK calls these callbacks whenever it needs the credentials. It's quite expensive to get the credentials as it would involve reaching out to cbauth.
Thus, it's best if the SDK caches the credentials. The SDK has the ability to discern if an auth failure has taken place (as it parses the final N1QL row). On such an event, it can invalidate its cache and call the dynamic auth callbacks to get fresh credentials.