Add support for JSON payload in OAuth2 Client Credentials flow#92
Open
dabla wants to merge 1 commit intoColin-b:developfrom
Open
Add support for JSON payload in OAuth2 Client Credentials flow#92dabla wants to merge 1 commit intoColin-b:developfrom
dabla wants to merge 1 commit intoColin-b:developfrom
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR extends OAuth2ClientCredentials to support sending the token request payload as JSON instead of the default application/x-www-form-urlencoded.
🚀 Motivation
While RFC 6749 specifies form-encoded payloads for the client credentials grant, some APIs in the wild require the token request to be sent as JSON. This currently makes requests_auth incompatible with those providers out of the box.
In our case, we encountered this limitation when integrating with certain REST APIs from an Apache Airflow environment (via HttpOperator), where JSON-based token endpoints are required.
🧩 What’s included
Introduced a new optional parameter: post_as_json (default: False)
When enabled:
The token request is sent using json=... instead of data=...
client_id and client_secret are included in the JSON body (instead of only via basic auth)
Backward compatible: existing behaviour remains unchanged unless explicitly enabled
🛠️ Example usage
📌 Notes
This change is particularly useful for non-standard OAuth2 implementations that deviate from the spec.
Unit tests for this feature will be added in a follow-up commit.