kora-http-client-authlisted

# Kora HTTP Client Auth > **Kora sub-skill — obey the [kora-v1 meta rules](../../SKILL.md) on every task:** **R0** ensure `.kora-agent/` docs+examples are cloned · **R1** read this sub-skill before writing code · **R2** Kora APIs only — no Spring/Micronaut/Quarkus, no invented annotations or config keys · **R3** journal any incorrect Kora usage. Add comments/Javadoc only if asked. Authenticate outgoing requests from a declarative `@HttpClient`. Kora ships ready-made `HttpClientInterceptor` implementations for Basic, API-key and Bearer schemes; attach any interceptor with `@InterceptWith`. For dynamic tokens (OAuth2 client credentials, refreshable JWT) you implement `HttpClientTokenProvider` or write your own `HttpClientInterceptor`. **Level:** Intermediate (requires `kora-http-client` and `kora-di-compile`). **Key facts (verify against the source of truth):** - There is **no** `ru.tinkoff.kora:http-client-auth` artifact. Auth lives in `http-client-common` and is wired through interceptors. - Built-in interceptors: `BasicAuthHttpClientInterceptor`, `ApiKeyHttpClientInterceptor`, `BearerAuthHttpClientInterceptor`. - `HttpClientTokenProvider` is the extension point for Bearer tokens; the Bearer interceptor calls it on every request. - Interceptors are attached with `@InterceptWith(...)`, **not** an `interceptors = {...}` attribute on `@HttpClient`. - The target URL is set in config (`httpClient.<client>.url`), **not** a `baseUrl` annotation attribute. --- ## Quic