fix(rust): apply client custom headers to the OAuth token request

generators/rust/base/src/asIs/http_client.rs

@@ -420,6 +420,12 @@ impl HttpClient {
     /// The request body and response are keyed by the property names configured on the
     /// API's OAuth scheme (via `exchange`), so non-standard token contracts (e.g. camelCase
     /// field names or an absent `grant_type`) are honored instead of a hardcoded shape.
+    ///
+    /// Config-level custom headers are applied to the token request, since gateways often
+    /// require them on the token endpoint too. Request-level headers are deliberately not
+    /// applied: the token is cached and shared across requests, so it must not depend on the
+    /// options of whichever request happens to trigger the fetch. Auth headers are also not
+    /// applied, as this request is what produces the credential they would carry.
     async fn fetch_oauth_token(
         &self,
         base_url: &str,
@@ -445,11 +451,17 @@ impl HttpClient {
         }
         let body = serde_json::Value::Object(body);
 
-        let response = self
+        let mut request = self
             .client
             .request(Method::POST, &url)
             .json(&body)
-            .send()
+            .build()
+            .map_err(ApiError::Network)?;
+        self.apply_custom_headers(&mut request, &None)?;
+
+        let response = self
+            .client
+            .execute(request)
             .await
             .map_err(ApiError::Network)?;
 
@@ -755,4 +767,67 @@ mod tests {
         assert!(!HttpClient::is_retryable_status(401));
         assert!(!HttpClient::is_retryable_status(404));
     }
+
+    /// Accepts a single connection, returns the raw request text and replies with a token.
+    async fn serve_one_token_request(
+        listener: tokio::net::TcpListener,
+    ) -> String {
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+        let (mut socket, _) = listener.accept().await.expect("accept");
+        let mut raw = Vec::new();
+        let mut buffer = [0u8; 1024];
+        loop {
+            let read = socket.read(&mut buffer).await.expect("read");
+            raw.extend_from_slice(&buffer[..read]);
+            if read == 0 || String::from_utf8_lossy(&raw).contains("\r\n\r\n") {
+                break;
+            }
+        }
+
+        let body = r#"{"access_token":"token-from-server","expires_in":3600}"#;
+        let response = format!(
+            "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+        socket.write_all(response.as_bytes()).await.expect("write");
+        socket.flush().await.expect("flush");
+
+        String::from_utf8_lossy(&raw).to_string()
+    }
+
+    #[tokio::test]
+    async fn test_oauth_token_request_sends_custom_headers() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind");
+        let base_url = format!("http://{}", listener.local_addr().expect("addr"));
+        let server = tokio::spawn(serve_one_token_request(listener));
+
+        let mut config = ClientConfig::default();
+        config.base_url = base_url;
+        config
+            .custom_headers
+            .insert("X-Gateway-Token".to_string(), "sunflower".to_string());
+        let client = HttpClient::new(config).expect("client");
+
+        let (access_token, _) = client
+            .fetch_oauth_token(
+                &client.config.base_url.clone(),
+                "/token",
+                "client-id",
+                "client-secret",
+                &OAuthTokenExchangeConfig::default(),
+            )
+            .await
+            .expect("token");
+
+        let raw_request = server.await.expect("server");
+        assert_eq!(access_token, "token-from-server");
+        assert!(
+            raw_request.contains("x-gateway-token: sunflower"),
+            "token request is missing the client's custom headers: {raw_request}"
+        );
+    }
 }

generators/rust/sdk/changes/unreleased/fix-oauth-token-request-custom-headers.yml

@@ -0,0 +1,13 @@
+# yaml-language-server: $schema=../../../../../fern-changes-yml.schema.json
+
+- summary: |
+    Apply client-level custom headers to the OAuth token request. The client-credentials
+    token exchange was built directly on the underlying HTTP client, so it was the only
+    request that skipped `ClientConfig.custom_headers` — APIs whose gateway requires a
+    header on the token endpoint rejected the exchange with a 401, and the
+    `X-Fern-SDK-*` headers were missing from token requests.
+
+    Request-level headers and auth headers are intentionally still not applied: the token
+    is cached and shared across requests, and the token request is what produces the
+    credential auth headers would carry.
+  type: fix

generators/rust/sdk/src/__test__/snapshots/http-client-api-key.rs

@@ -420,6 +420,12 @@ impl HttpClient {
     /// The request body and response are keyed by the property names configured on the
     /// API's OAuth scheme (via `exchange`), so non-standard token contracts (e.g. camelCase
     /// field names or an absent `grant_type`) are honored instead of a hardcoded shape.
+    ///
+    /// Config-level custom headers are applied to the token request, since gateways often
+    /// require them on the token endpoint too. Request-level headers are deliberately not
+    /// applied: the token is cached and shared across requests, so it must not depend on the
+    /// options of whichever request happens to trigger the fetch. Auth headers are also not
+    /// applied, as this request is what produces the credential they would carry.
     async fn fetch_oauth_token(
         &self,
         base_url: &str,
@@ -445,11 +451,17 @@ impl HttpClient {
         }
         let body = serde_json::Value::Object(body);
 
-        let response = self
+        let mut request = self
             .client
             .request(Method::POST, &url)
             .json(&body)
-            .send()
+            .build()
+            .map_err(ApiError::Network)?;
+        self.apply_custom_headers(&mut request, &None)?;
+
+        let response = self
+            .client
+            .execute(request)
             .await
             .map_err(ApiError::Network)?;
 
@@ -755,4 +767,67 @@ mod tests {
         assert!(!HttpClient::is_retryable_status(401));
         assert!(!HttpClient::is_retryable_status(404));
     }
+
+    /// Accepts a single connection, returns the raw request text and replies with a token.
+    async fn serve_one_token_request(
+        listener: tokio::net::TcpListener,
+    ) -> String {
+        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+        let (mut socket, _) = listener.accept().await.expect("accept");
+        let mut raw = Vec::new();
+        let mut buffer = [0u8; 1024];
+        loop {
+            let read = socket.read(&mut buffer).await.expect("read");
+            raw.extend_from_slice(&buffer[..read]);
+            if read == 0 || String::from_utf8_lossy(&raw).contains("\r\n\r\n") {
+                break;
+            }
+        }
+
+        let body = r#"{"access_token":"token-from-server","expires_in":3600}"#;
+        let response = format!(
+            "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+        socket.write_all(response.as_bytes()).await.expect("write");
+        socket.flush().await.expect("flush");
+
+        String::from_utf8_lossy(&raw).to_string()
+    }
+
+    #[tokio::test]
+    async fn test_oauth_token_request_sends_custom_headers() {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind");
+        let base_url = format!("http://{}", listener.local_addr().expect("addr"));
+        let server = tokio::spawn(serve_one_token_request(listener));
+
+        let mut config = ClientConfig::default();
+        config.base_url = base_url;
+        config
+            .custom_headers
+            .insert("X-Gateway-Token".to_string(), "sunflower".to_string());
+        let client = HttpClient::new(config).expect("client");
+
+        let (access_token, _) = client
+            .fetch_oauth_token(
+                &client.config.base_url.clone(),
+                "/token",
+                "client-id",
+                "client-secret",
+                &OAuthTokenExchangeConfig::default(),
+            )
+            .await
+            .expect("token");
+
+        let raw_request = server.await.expect("server");
+        assert_eq!(access_token, "token-from-server");
+        assert!(
+            raw_request.contains("x-gateway-token: sunflower"),
+            "token request is missing the client's custom headers: {raw_request}"
+        );
+    }
 }