fix: add auth_methods client_secret_basic for refresh token and revok…

[kufd]

I have an authentication provider that only accepts client secrets from the request headers.

Because of this, the refresh token and revoke token requests fail — the Authorization header is missing.

This PR adds the Authorization header with the client credentials to those requests.
Additionally, I’ve updated how the header is added in other requests to follow the same approach.

I’d appreciate any feedback and am happy to adjust the PR as needed.

[rajatcing]

cc @elinashoko

[elinashoko]

heya @kufd thank you for your contribution, we'll review as soon as we can!

[muhlemmer]

@kufd, can you plead amend the description of you PR and clearly state:

• What is the bug being solved. Preferably an issue with a reproducible case
• How is the bug solved

It's hard to understand the problem and the fix looking at the code alone.

[kufd]

@muhlemmer Could you please take a look at the PR description?
I’ve updated it — I hope it looks better now.

[elinashoko]

@muhlemmer pls have a look

[elinashoko]

@muhlemmer ping pls

[muhlemmer]

Change looks good, thanks. One small formatting comment.

[muhlemmer]

Please move the import to the lower block, with the other same-module import.

[kufd]

Done
Could you please take a look

[elinashoko]

@muhlemmer pls review this again, thanks!

[github-actions]

🎉 This PR is included in version 3.45.5 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[suqin-haha]

is this PR cause the problem (at least for Okta)?
ErrorType=invalid_request Description=Cannot supply multiple client credentials. Use one of the following: credentials in the Authorization header, credentials in the post body, or a client_assertion in the post body

@muhlemmer @kufd @elinashoko

[muhlemmer]

@suqin-haha if you're experiencing problems after upgrading this library in your app, please open an issue with clear steps to reproduce, so we can investigate.

[kufd]

I would like to confirm that in this pull request I have added client credentials to the headers for the refresh token and revoke token requests. As a result, the client credentials are now present in both the request body and the headers.

For the device authorization request and the device access token request, the client credentials were already included in both places (body and headers) before this PR.