kora-http-client-auth

Kora HTTP Client Auth

Kora sub-skill — obey the kora-v1 meta rules on every task: R0 ensure .kora-agent/ docs+examples are cloned · R1 read this sub-skill before writing code · R2 Kora APIs only — no Spring/Micronaut/Quarkus, no invented annotations or config keys · R3 journal any incorrect Kora usage. Add comments/Javadoc only if asked.

Authenticate outgoing requests from a declarative @HttpClient. Kora ships ready-made HttpClientInterceptor implementations for Basic, API-key and Bearer schemes; attach any interceptor with @InterceptWith. For dynamic tokens (OAuth2 client credentials, refreshable JWT) you implement HttpClientTokenProvider or write your own HttpClientInterceptor.

Level: Intermediate (requires kora-http-client and kora-di-compile).

Key facts (verify against the source of truth):

• There is no ru.tinkoff.kora:http-client-auth artifact. Auth lives in http-client-common and is wired through interceptors.
• Built-in interceptors: BasicAuthHttpClientInterceptor, ApiKeyHttpClientInterceptor, BearerAuthHttpClientInterceptor.
• HttpClientTokenProvider is the extension point for Bearer tokens; the Bearer interceptor calls it on every request.
• Interceptors are attached with @InterceptWith(...), not an interceptors = {...} attribute on @HttpClient.
• The target URL is set in config (httpClient.<client>.url), not a baseUrl annotation attribute.

---

Quick Start

build.gradle — note the mandatory annotation processor:

dependencies {
    koraBom platform("ru.tinkoff.kora:kora-parent:1.2.19")

    annotationProcessor "ru.tinkoff.kora:annotation-processors"

    implementation "ru.tinkoff.kora:config-hocon"
    implementation "ru.tinkoff.kora:http-client-common"
    implementation "ru.tinkoff.kora:http-client-ok"   // OkHttp transport
    implementation "ru.tinkoff.kora:json-module"
    implementation "ru.tinkoff.kora:logging-logback"
}