workloadidentity

type Config ¶

type Config struct {
	// Provider names the provider instance in logs.
	Provider string
	Grant    Grant
	// TokenEndpoint is the exchange URL; see DefaultTokenEndpoint.
	TokenEndpoint string
	config.WorkloadIdentityConfig
}

Config is a resolved workload identity configuration for one provider.

func (c Config) Validate() error

type Grant ¶

type Grant string

Grant selects the OAuth grant a provider's token endpoint speaks.

const (
	// TokenExchange is the RFC 8693 token exchange OpenAI uses.
	TokenExchange Grant = "token_exchange"
	// JWTBearer is the RFC 7523 jwt-bearer grant Anthropic uses.
	JWTBearer Grant = "jwt_bearer"
)

type Source ¶

type Source struct {
	// contains filtered or unexported fields
}

Source hands out a cached provider access token, exchanging the identity token for a new one ahead of expiry. It is safe for concurrent use.

No exchange runs under the lock. While the cached token is still usable, callers get it immediately and one refresh runs in the background. Callers without a usable token wait for the shared exchange, and each stops waiting when its own context ends.

func New(cfg Config, client *http.Client) (*Source, error)

func (s *Source) Token(ctx context.Context) (string, error)