Struct ApiKeyCredential 

pub struct ApiKeyCredential { /* private fields */ }

Exchanges an application API key for short-lived Dex access tokens.

Use this when an application holds a long-lived API key and Dex requires bearer tokens. Use crate::FileCredential when another process writes ready-to-use tokens to a file. Unlike other Credential implementations, construction is async: ApiKeyCredentialBuilder::build performs the first exchange so an invalid key fails before Client or Worker creation. The synchronous Credential::token reads only the cache and never performs network I/O.

A background Tokio task refreshes at 80% of each token’s lifetime. Concurrent callers use the same cached token and only one exchange runs at a time. After a failed refresh, the current token remains usable until expiry and refresh is retried no more often than every five seconds. An expired token fails calls until a refresh succeeds. A unary Dex call rejected with gRPC Unauthenticated discards that exact token and retries once after a fresh exchange. Dex rejects unauthenticated calls before execution, so the retry is safe. Worker poll streams discard rejected tokens and reconnect once immediately. A second rejection uses the normal backoff.

The credential is safe to share across threads. Its background task is aborted when the last owner drops it. Client and Worker release their references when dropped; applications holding another Arc should drop that reference to stop refreshing. Keep the Tokio runtime used for construction alive and driving tasks while the credential is in use. A multi-thread runtime does this while it remains alive; a current-thread runtime must be continuously driven. Debug output and exchange errors omit the API key and access tokens.

use std::{sync::Arc, time::Duration};
use dex_sdk::{ApiKeyCredential, ClientOptions, WorkerOptions};
let runtime = tokio::runtime::Runtime::new()?;
let credential = Arc::new(runtime.block_on(ApiKeyCredential::builder(
    "https://auth.example.com/token", "my-dex-server", "application-api-key",
).exchange_timeout(Duration::from_secs(10)).build())?);
let client_options = ClientOptions::new().credential(credential.clone());
let worker_options = WorkerOptions::new().credential(credential);

Implementations

impl ApiKeyCredential

pub fn builder( token_url: impl Into<String>, server_id: impl Into<String>, api_key: impl Into<String>, ) -> ApiKeyCredentialBuilder

Starts configuration of an API-key credential.

token_url identifies the exchange endpoint. server_id scopes its access token, and api_key is the application secret. All three values are required. Validation and the first exchange occur in ApiKeyCredentialBuilder::build.

Trait Implementations

impl Credential for ApiKeyCredential

fn token(&self) -> Result<String, CredentialError>

Returns the current bare token, or an error that fails the request locally.

fn discard_rejected_token(&self, rejected_token: &str)

Discards a token rejected by Dex if it is still the credential’s cached token.

fn token_after_rejection( &self, ) -> Option<Pin<Box<dyn Future<Output = Result<String, CredentialError>> + Send + '_>>>

Supplies an asynchronous fresh token after rejection when supported.

impl Debug for ApiKeyCredential

fn fmt(&self, formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Drop for ApiKeyCredential

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.