Interface BearerTokenProvider

All Known Implementing Classes:
StaticBearerTokenProvider, SupplierBearerTokenProvider
Functional Interface:
This is a functional interface and can therefore be used as the assignment target for a lambda expression or method reference.
@FunctionalInterface public interface BearerTokenProvider
Supplies the bearer token that signs every authenticated request, as an alternative to OAuth2 client credentials.

Use it when a client-credentials token is not accepted. The live case (2026-11-11): IAM project-scoped endpoints such as /v1/projects/{project}/roles and principalPolicies answer "Project arg only supported when using an access-policy auth token" to a client-credentials token, and need an STS-issued access-policy token instead. Another case is a token minted outside the SDK by a workload-identity flow.

The SDK calls getToken() on the first authenticated request, again shortly before a known expiry, and once more after a request is answered with HTTP 401 (that request is then replayed once with the new token; a second 401 is thrown). Calls are single-flight: concurrent requests that need a token cause one call. Implementations should be thread-safe.

IAM iam = new IAM(BearerTokenProvider.of(accessPolicyToken));
IAM rotating = new IAM(BearerTokenProvider.from(() -> sts.exchange(...)));
try (Equinix eq = new Equinix(BearerTokenProvider.from(myTokenSource))) { ... }
Author:
ianjones
See Also:

  • Method Summary

    Modifier and Type
    Method
    Description
    static BearerTokenProvider
    from(Supplier<BearerToken> supplier)
    A provider that obtains each token from a supplier, for example one that performs an STS token exchange or reads a rotated file.
    BearerToken
    getToken()
    Returns the token to sign requests with.
    static BearerTokenProvider
    of(String token)
    A provider that always returns the same token (no known expiry).

  • Method Details

    • getToken

      BearerToken getToken()
      Returns the token to sign requests with. Called once per (re-)authentication.
      Returns:
      the current token; must not be null

    • of

      static BearerTokenProvider of(String token)
      A provider that always returns the same token (no known expiry). After a 401 the SDK asks again, gets the same token, replays once, and then surfaces the second 401.
      Parameters:
      token - the bearer token value
      Returns:
      the provider

    • from

      static BearerTokenProvider from(Supplier<BearerToken> supplier)
      A provider that obtains each token from a supplier, for example one that performs an STS token exchange or reads a rotated file.
      Parameters:
      supplier - supplies a fresh token on each call
      Returns:
      the provider