Struct OAuth2ClientCredentials 

pub struct OAuth2ClientCredentials {
    pub token_endpoint: String,
    pub client_id: String,
    pub client_secret: String,
    pub scopes: Vec<String>,
    pub mtls: Option<OAuth2Mtls>,
    pub token_cache_ttl_s: Option<u64>,
}

OAuth2 client-credentials configuration for an upstream (DW-035, upstreams[].oauth2_client_credentials).

The gateway obtains an access token from token_endpoint using the client-credentials grant (RFC 6749 section 4.4) and forwards it to the upstream as Authorization: Bearer <token>. The client authenticates to the token endpoint with HTTP Basic auth (client_id:client_secret, RFC 6749 section 2.3.1). Tokens are cached per upstream (keyed by upstream name on the dataplane) and refreshed lazily on the first request after expiry — no background refresh task. An optional mtls block configures a client certificate for the TLS handshake to the token endpoint itself (RFC 8705, the tls_client_auth method).

Fields

token_endpoint: String

The token endpoint URL (RFC 6749 section 3.2). Must be an absolute http(s):// URL; validation rejects anything else.

client_id: String

The client identifier presented to the token endpoint (RFC 6749 section 2.2). Sent as the username of the HTTP Basic auth header.

client_secret: String

The client secret presented to the token endpoint (RFC 6749 section 2.3.1). Either the value INLINE (redacted in every config echo, DW-045) or a ${...} secret reference (env or file) resolved at config-compile time and re-read on every reload. Sent as the password of the HTTP Basic auth header.

scopes: Vec<String>

Optional scope string (RFC 6749 section 3.3): a space-delimited list of requested scopes sent in the token request body. Absent = no scope parameter (the endpoint’s default scopes apply).

mtls: Option<OAuth2Mtls>

Optional mTLS client certificate for the TLS handshake to the token endpoint itself (RFC 8705 tls_client_auth). Absent: the token endpoint’s TLS is negotiated with no client certificate (the default webpki root set, or a trusted_ca_file when the token endpoint is behind a private CA — note the token endpoint trust is NOT the upstream’s trusted_ca_file; the token endpoint is a separate entity).

token_cache_ttl_s: Option<u64>

Token cache TTL override in seconds. Absent (the default): use the token’s own expires_in (minus a refresh skew margin). When set, the cache TTL is min(token_expires_in - skew, token_cache_ttl_s) so a shorter override never extends a token’s real lifetime. Must be > 0.

Trait Implementations

impl Clone for OAuth2ClientCredentials

fn clone(&self) -> OAuth2ClientCredentials

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OAuth2ClientCredentials

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for OAuth2ClientCredentials

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for OAuth2ClientCredentials

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for OAuth2ClientCredentials

fn eq(&self, other: &OAuth2ClientCredentials) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for OAuth2ClientCredentials

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for OAuth2ClientCredentials