Declarative OAuth2 client-credentials auth. When set on ToolkitConfig,
the SDK mints, caches, and attaches a Bearer token to egress automatically,
so handlers never touch the token dance. The client id/secret are resolved
from the vault by name (both must appear in the manifest secrets), and the
tokenUrl host and apiHost must appear in the manifest egress.
| Property | Type | Description |
|---|
apiHost | string | Required. The Bearer is attached ONLY to requests whose host equals this value — never to any other egress target, and never to the mint call. This scoping is what prevents the token from leaking to a third-party host. |
clientIdSecret | string | Manifest secret name holding the client id. |
clientSecretSecret | string | Manifest secret name holding the client secret. |
scope? | string | Optional space-delimited scope string sent with the grant. |
tokenUrl | string | The token endpoint (client-credentials grant, HTTP Basic client auth). |
type | "oauth2_client_credentials" | Discriminant; the only supported flow today. |