Owns the Management API token: fetching it, caching it, and renewing it.
Only one fetch is ever in flight. Callers arriving while a fetch is running wait
for it rather than starting their own, so a cold cache under load produces one
request to Auth0 instead of one per caller — /oauth/token is rate-limited, and
a stampede there fails every caller at once.
Tokens are renewed shortly before they expire, by Auth0Client.Config.token_refresh_skew/0
seconds, so a token cannot lapse midway through a request that is already on the wire.
Summary
Functions
Returns a specification to start this module under a supervisor.
See Supervisor.
@spec fetch() :: {:ok, String.t()} | {:error, Auth0Client.Error.t()}
Returns a valid Management API token, fetching one if the cache is empty or stale.
@spec invalidate() :: :ok
Discards the cached token, so the next fetch/0 obtains a new one.
Called when Auth0 rejects the token with a 401 — the secret may have rotated, or the client may have been revoked.