[feature] Extra token request parameters for OAuth client credentials (Auth0 audience) #2265

The problem

I want to connect Auth0's Management API (https://<tenant>.auth0.com/api/v2) with a machine-to-machine app, using the client-credentials grant. Auth0 only issues that token when the request names the API in audience:

POST https://<tenant>.auth0.com/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials&client_id=…&client_secret=…&audience=https://<tenant>.auth0.com/api/v2/

Executor's client-credentials exchange sends only scope and resource (exchangeClientCredentials in packages/core/sdk/src/oauth-helpers.ts; clientCredentials in packages/sdk/src/implementation/oauth-protocol.ts on the v2 branch). Auth0 ignores resource on this grant and answers:

{"error":"access_denied","error_description":"No audience parameter was provided, and no default audience has been configured"}

Auth0's Resource Parameter Compatibility Profile, which maps resource to audience, lists /authorize, PAR, JAR, CIBA and refresh tokens, but not client credentials. A query string on the token URL (/oauth/token?audience=…) is ignored too. The only Auth0-side alternative is a tenant-wide default audience, which changes every other app's logins.

Neither the Register OAuth app form nor oauth.clients.create / createHandoff / the oauth2 authentication template takes extra token parameters. Extra parameters exist only for first-party clients (authorizationExtraParams, e.g. Atlassian's audience), and on v2 authorizationParams applies only to the sign-in request.

Proposed shape

An optional, non-secret tokenParams map on a registered OAuth client (the Register OAuth app form, oauth.clients.create and oauth.clients.createHandoff), and on the oauth2 authentication template. Executor would add it to every token request it makes for that client: the client-credentials exchange, the re-mint on expiry, and refresh. Protocol names (grant_type, client_id, client_secret, scope, resource, code, code_verifier, redirect_uri, refresh_token) are rejected, the same way authorizationParams rejects them.

For Auth0 that is tokenParams: { audience: "https://<tenant>.auth0.com/api/v2/" }. Other providers that read audience on client credentials have the same gap.

Alternatives

I run a small relay: the OAuth app's token URL points at a function that adds audience and forwards the request to Auth0. It works, but the client secret passes through one more hop, and every Auth0 user has to build and host the same relay.

Where it belongs

Executor Cloud (and every host that shares the OAuth client code).

Before you submit

• I searched the open issues for a duplicate.