refactor(oauth): remove use_client_credentials_in_refresh option

The core fix (excluding credentials from body when Authorization header is present)
is sufficient for Gong and similar OAuth providers. The additional
use_client_credentials_in_refresh option was added during confusion about
Gong's requirements and is no longer needed.

This simplifies the implementation while maintaining the correct behavior:
- When refresh_request_headers contains an Authorization header, client_id
  and client_secret are automatically excluded from the request body
- This is required by OAuth providers like Gong that expect credentials
  ONLY in the Authorization header

Co-Authored-By: aldo.gonzalez@airbyte.io <aldo.gonzalez@airbyte.io>

Author: devin-ai-integration[bot]

airbyte_cdk/sources/declarative/auth/oauth.py

@@ -78,7 +78,6 @@ class DeclarativeOauth2Authenticator(AbstractOauth2Authenticator, DeclarativeAut
     refresh_token_error_status_codes: Tuple[int, ...] = ()
     refresh_token_error_key: str = ""
     refresh_token_error_values: Tuple[str, ...] = ()
-    _use_client_credentials_in_refresh: bool = True
 
     def __post_init__(self, parameters: Mapping[str, Any]) -> None:
         super().__init__(
@@ -248,9 +247,6 @@ def get_refresh_request_body(self) -> Mapping[str, Any]:
     def get_refresh_request_headers(self) -> Mapping[str, Any]:
         return self._refresh_request_headers.eval(self.config)
 
-    def use_client_credentials_in_refresh(self) -> bool:
-        return self._use_client_credentials_in_refresh
-
     def get_token_expiry_date(self) -> AirbyteDateTime:
         if not self._has_access_token_been_initialized():
             return AirbyteDateTime.from_datetime(datetime.min)

airbyte_cdk/sources/declarative/declarative_component_schema.yaml

@@ -1531,11 +1531,6 @@ definitions:
         description: Enable using profile assertion as a flow for OAuth authorization.
         type: boolean
         default: false
-      use_client_credentials_in_refresh:
-        title: Use Client Credentials In Refresh
-        description: When enabled (default), client_id and client_secret are included in the refresh token request body. Set to false for OAuth implementations like Gong that require only the refresh_token in the request body without client credentials.
-        type: boolean
-        default: true
       $parameters:
         type: object
         additionalProperties: true

airbyte_cdk/sources/declarative/models/declarative_component_schema.py

@@ -1941,11 +1941,6 @@ class OAuthAuthenticator(BaseModel):
         description="Enable using profile assertion as a flow for OAuth authorization.",
         title="Use Profile Assertion",
     )
-    use_client_credentials_in_refresh: Optional[bool] = Field(
-        True,
-        description="When enabled (default), client_id and client_secret are included in the refresh token request body. Set to false for OAuth implementations like Gong that require only the refresh_token in the request body without client credentials.",
-        title="Use Client Credentials In Refresh",
-    )
     parameters: Optional[Dict[str, Any]] = Field(None, alias="$parameters")
 
 

airbyte_cdk/sources/declarative/parsers/model_to_component_factory.py

@@ -2833,9 +2833,6 @@ def create_oauth_authenticator(
             refresh_token_error_status_codes=refresh_token_error_status_codes,
             refresh_token_error_key=refresh_token_error_key,
             refresh_token_error_values=refresh_token_error_values,
-            _use_client_credentials_in_refresh=model.use_client_credentials_in_refresh
-            if model.use_client_credentials_in_refresh is not None
-            else True,
         )
 
     @staticmethod

airbyte_cdk/sources/streams/http/requests_native_auth/abstract_oauth.py

@@ -104,19 +104,17 @@ def build_refresh_request_body(self) -> Mapping[str, Any]:
 
         Override to define additional parameters.
 
-        Client credentials (client_id and client_secret) are excluded from the body when:
-        1. refresh_request_headers contains an Authorization header (e.g., Basic auth), OR
-        2. use_client_credentials_in_refresh() returns False (for APIs like Gong that don't
-           require client credentials in the refresh request at all)
+        Client credentials (client_id and client_secret) are excluded from the body when
+        refresh_request_headers contains an Authorization header (e.g., Basic auth).
+        This is required by OAuth providers like Gong that expect credentials ONLY in the
+        Authorization header and reject requests that include them in both places.
         """
         # Check if credentials are being sent via Authorization header
         headers = self.get_refresh_request_headers()
         credentials_in_header = headers and "Authorization" in headers
 
-        # Check if client credentials should be included in refresh request
-        include_client_credentials = (
-            self.use_client_credentials_in_refresh() and not credentials_in_header
-        )
+        # Only include client credentials in body if not already in header
+        include_client_credentials = not credentials_in_header
 
         payload: MutableMapping[str, Any] = {
             self.get_grant_type_name(): self.get_grant_type(),
@@ -518,14 +516,6 @@ def get_grant_type(self) -> str:
     def get_grant_type_name(self) -> str:
         """Returns grant_type specified name for requesting access_token"""
 
-    def use_client_credentials_in_refresh(self) -> bool:
-        """Returns whether to include client credentials in the refresh token request body.
-
-        Override to return False for OAuth implementations (like Gong) that don't require
-        client_id and client_secret in the refresh request.
-        """
-        return True
-
     @property
     @abstractmethod
     def access_token(self) -> str:

unit_tests/sources/declarative/auth/test_oauth.py

@@ -169,63 +169,6 @@ def test_refresh_request_body_includes_credentials_when_no_authorization_header(
         }
         assert body == expected
 
-    def test_refresh_request_body_excludes_credentials_when_use_client_credentials_in_refresh_is_false(
-        self,
-    ):
-        """
-        When use_client_credentials_in_refresh is set to False, client_id and client_secret
-        should be excluded from the request body entirely.
-
-        This is required by OAuth providers like Gong that don't require client credentials
-        in the refresh token request at all - only the refresh_token is needed.
-        """
-        oauth = DeclarativeOauth2Authenticator(
-            token_refresh_endpoint="{{ config['refresh_endpoint'] }}",
-            client_id="{{ config['client_id'] }}",
-            client_secret="{{ config['client_secret'] }}",
-            refresh_token="{{ parameters['refresh_token'] }}",
-            config=config,
-            token_expiry_date="{{ config['token_expiry_date'] }}",
-            parameters=parameters,
-            grant_type="{{ config['grant_type'] }}",
-            _use_client_credentials_in_refresh=False,
-        )
-        body = oauth.build_refresh_request_body()
-        expected = {
-            "grant_type": "some_grant_type",
-            "refresh_token": "some_refresh_token",
-        }
-        assert body == expected
-        assert "client_id" not in body
-        assert "client_secret" not in body
-
-    def test_refresh_request_body_includes_credentials_when_use_client_credentials_in_refresh_is_true(
-        self,
-    ):
-        """
-        When use_client_credentials_in_refresh is True (default), client_id and client_secret
-        should be included in the request body.
-        """
-        oauth = DeclarativeOauth2Authenticator(
-            token_refresh_endpoint="{{ config['refresh_endpoint'] }}",
-            client_id="{{ config['client_id'] }}",
-            client_secret="{{ config['client_secret'] }}",
-            refresh_token="{{ parameters['refresh_token'] }}",
-            config=config,
-            token_expiry_date="{{ config['token_expiry_date'] }}",
-            parameters=parameters,
-            grant_type="{{ config['grant_type'] }}",
-            _use_client_credentials_in_refresh=True,
-        )
-        body = oauth.build_refresh_request_body()
-        expected = {
-            "grant_type": "some_grant_type",
-            "client_id": "some_client_id",
-            "client_secret": "some_client_secret",
-            "refresh_token": "some_refresh_token",
-        }
-        assert body == expected
-
     def test_refresh_with_encode_config_params(self):
         oauth = DeclarativeOauth2Authenticator(
             token_refresh_endpoint="{{ config['refresh_endpoint'] }}",