TokenAuthenticator

OkHttp okhttp3.Authenticator that automatically refreshes the Bearer access token whenever a 401 Unauthorized response is received from a Bearer-protected endpoint.

On a 401 from a regular Bearer endpoint the authenticator:

1. Verifies the failed request was using Bearer auth (skips Basic-Auth or unauthenticated requests).

2. Guards against infinite retry loops (max 1 retry per request).

3. Calls the MTN MoMo token endpoint via a dedicated AuthenticationService backed by a Basic-Auth-only OkHttpClient with no authenticator, avoiding circular dependency.

4. Saves the refreshed Bearer token to CredentialStorage.

5. If the OAuth2 access token is also expired, refreshes it via AuthenticationService.getOauth2AccessToken and saves it to CredentialStorage.

6. Returns the original request without modification — the io.rekast.sdk.network.interceptor.auth.AccessTokenInterceptor will read the new token from storage and attach the correct header on the retry pass.

On a 401 from an OAuth2 (consent) resource endpoint — one whose path contains the Constants.EndpointPaths.OAUTH2 segment but not the Constants.EndpointPaths.TOKEN segment, e.g. /{productType}/oauth2/{apiVersion}/userinfo — it refreshes only the OAuth2 consent token (bc-authorize → oauth2/token) and retries, since those endpoints are authenticated with the consent token rather than the regular Bearer token. The OAuth2 token endpoint (/{productType}/oauth2/token/) is treated as a regular Bearer endpoint — it mints the consent token and must not itself be authenticated with it.

Parameters