v0.38.0
New: OAuth Password Grant
The oauth_token transform now supports the RFC 6749 4.3 resource-owner password grant. Configure grant: password with username, password, and client_id (plus optional client_secret). Caching, single-flight, and token refresh on expiry behave the same as the other grant types.
- name: oauth_token
config:
tokens:
- grant: password
username: {type: env, var: API_USERNAME}
password: {type: env, var: API_PASSWORD}
client_id: {type: env, var: API_CLIENT_ID}
client_secret: {type: env, var: API_CLIENT_SECRET}
token_endpoint: "https://api.example.com/token"
rules:
- host: "api.example.com"New: Token Endpoint Headers
A new token_endpoint_headers map on any oauth_token grant sends extra headers on the token POST itself. Each value is a discrete secret source. Use this when the token endpoint requires an API key or other credential alongside the standard form-body client auth.
token_endpoint_headers:
x-api-key: {type: env, var: API_KEY}