Are we concerned with Key collisions? Should this provider have the highest priority over header control?

Opted to give the HeadersProvider priority over static Headers. This approach removes an edge case in newRequest.

This does not allow to e.g. to refresh token when getting a 401 error.

The HeadersProvider is executed with every call to newRequest. This should enable implementers to configure a HeadersProviderFunc that can hook into required token lifecycle components for each request. See oauth2/clientcredentials.

What if the access token is revoked? Do not we want to give the m the possibility to get a new one?

I think it’s important to point out a constraint in the scope of this effort. These changes are motivated by the need to provide dynamically generated headers with requests, namely an Authorization header whose value may change over time as access tokens are renewed. The implementer is responsible for any scaffolding required to produce the desired headers (or error).
Here is a reference on the client credentials flow that you or others may find useful.

I think it’s important to point out a constraint in the scope of this effort.

What do you mean? Not gracefully supporting one of the possible oauth scenarios/flows?

I am not sure if it would not be more flexible and easier if we simply add an WithHTTPClient or WithHTTPTransport option (similarly to https://pkg.go.dev/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc#WithGRPCConn). Then you would be able to use https://pkg.go.dev/golang.org/x/oauth2/clientcredentials#Config.Client. WDYT? I think there was some prior art for it... Probably worth digging into some older issues and PRs

After quick search:

• Add support for custom HTTP Transports for the otlphttp driver #1858
• OTLP*HTTP Exporter: Custom HTTP client #2632
• OAuth2 Authentication for OTLP-HTTP Exporter/Client #4536

My goal here is to provide a way to set dynamic headers, not implement graceful OAuth2 support. Implementers can bring their own. For example:

package main

import (
	"context"
	"fmt"
	"net/url"
	"os"

	"go.opentelemetry.io/otel"
	"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp"
	"go.opentelemetry.io/otel/sdk/metric"
	"golang.org/x/oauth2/clientcredentials"
)

// NOTE: replace in go.mod:
// replace go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp => github.com/kevingentile/opentelemetry-go/exporters/otlp/otlpmetric/otlpmetrichttp v0.0.0-20250302224340-c40e5a3c2e22


func main() {
	ctx := context.Background()

	conf := clientcredentials.Config{
		ClientID:       os.Getenv("CLIENT_ID"),
		ClientSecret:   os.Getenv("CLIENT_SECRET"),
		TokenURL:       os.Getenv("TOKEN_URL"),
		EndpointParams: url.Values{"audience": {os.Getenv("AUDIENCE")}},
	}

	exp, err := otlpmetrichttp.New(ctx, otlpmetrichttp.WithHeadersProvider(func() (map[string]string, error) {
		token, err := conf.Token(ctx)
		if err != nil {
			return nil, fmt.Errorf("failed to get token: %w", err)
		}

		return map[string]string{
			"Authorization":       "Bearer " + token.AccessToken,
			"Some-Dynamic-Header": fmt.Sprint(os.Getpid()),
		}, nil
	}))
	if err != nil {
		panic(err)
	}

	meterProvider := metric.NewMeterProvider(metric.WithReader(metric.NewPeriodicReader(exp)))
	defer func() {
		if err := meterProvider.Shutdown(ctx); err != nil {
			panic(err)
		}
	}()
	otel.SetMeterProvider(meterProvider)
}