Struct Token 

pub struct Token { /* private fields */ }

Handle for obtaining OAuth2 bearer tokens.

Internally drives an aliri_tokens::TokenWatcher for background refresh and exposes lock-free reads via ArcSwap (same pattern as the JWKS key provider).

Token is Clone + Send + Sync — share freely across tasks.

Implementations

impl Token

pub async fn new(config: OAuthClientConfig) -> Result<Self, TokenError>

Create a new token handle and start background refresh.

This performs an initial token fetch — if the token endpoint is unreachable or returns an error, new will fail immediately.

Errors

Returns TokenError::ConfigError if the config is invalid. Returns TokenError::Http if the initial token fetch fails.

pub fn get(&self) -> Result<SecretString, TokenError>

Get the current bearer token.

This is a lock-free read from the ArcSwap-cached watcher — it never blocks on a network call. The underlying watcher refreshes the token in the background before it expires.

The returned SecretString wraps the raw access-token value so it is not accidentally logged.

Errors

Returns TokenError::Unavailable if the cached token has expired (the background watcher has not yet refreshed it).

pub async fn invalidate(&self)

Force-replace the internal watcher with a freshly-spawned one.

Use this after receiving a 401 from a downstream service to immediately discard a potentially revoked token.

If recreating the source or the initial token fetch fails, a warning is logged and the existing watcher is left in place.

Trait Implementations

impl Clone for Token

fn clone(&self) -> Token

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Token

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.