The headers sent on every request, regardless of API.

The Authorization header list for a bearer token.

Used both for the management token and for the tokens a caller supplies to the Authentication API — userinfo/1, the /mfa/* endpoints, global token revocation.

Removes a header by name, comparing case-insensitively.

Needed for multipart uploads: Req sets its own content-type carrying the boundary, but only with put_new_header, so the default application/json would win and the boundary would never be sent.

Merges extra headers into base, letting extra win on duplicate names.

Names are compared case-insensitively, so a per-request Authorization replaces the default one rather than being sent alongside it.

@spec mgmt_token() :: {:ok, String.t()} | {:error, Auth0Client.Error.t()}

Returns the management API token.

A statically configured token is used as-is and never cached; otherwise Auth0Client.TokenState supplies one, fetching and renewing as needed.

Normalises a list of permissions into the shape Auth0's RBAC endpoints expect.

Auth0 wants %{resource_server_identifier: _, permission_name: _} per permission, which is verbose to write by hand, so a {api_identifier, permission_name} tuple is accepted as shorthand:

normalize_permissions([{"https://api.example.com", "read:users"}])
#=> [%{resource_server_identifier: "https://api.example.com", permission_name: "read:users"}]

Maps pass through untouched, including the string-keyed maps Auth0 itself returns, so a permission read from one call can be fed straight into another.

@spec request_headers(atom(), list()) ::
  {:ok, list()} | {:error, Auth0Client.Error.t()}

Builds the headers for a request, merging in any per-request extra headers.

Management requests carry a bearer token, so this returns {:error, reason} if no token can be obtained.