Token exchange — credentials/token-exchange

# One native authentication POST per incoming XML request. The returned token
# is private and used immediately; this profile has no cache or extra retry.
server: {addr: ":8080", max_body_bytes: 20971520, max_inflight_requests: 16}
credentials:
  sample_exchange:
    kind: token_exchange
    token_url: https://login.example.net/auth/token
    allowed_origins: [https://api.example.net]
    request_format: json
    parameters: {mode: sample}
    secret_parameters:
      username: {provider: env, name: SAMPLE_USERNAME}
      password: {provider: env, name: SAMPLE_PASSWORD}
    token_path: token_field
    timeout: 5s
flows:
  xml_proxy:
    nodes:
      - {id: in, type: http_trigger, path: /proxy/xml, methods: [POST]}
      - {id: body, type: read_body, max_bytes: 20971520}
      - {id: auth, type: auth, scheme: exact, secret_ref: {provider: env, name: SAMPLE_INGRESS_TOKEN}, signature_header: X-Auth}
      - {id: env, type: envelope, body_format: raw}
      - {id: up, type: http_request, url: "https://api.example.net/xml", method: POST, credential: {profile: sample_exchange}, header_mode: replace, headers: {Content-Type: application/xml, Accept: application/xml}, max_response_bytes: 20971520}
      - {id: reply, type: respond, passthrough: true}
    edges: [in>body, body>auth, auth>env, env>up, up>reply]