Gotcha—here are quick, copy-paste ways to add an OIDC/JWT Bearer token to Java HTTP calls. Pick the stack you use.
Java 11+ HttpClient
var client = java.net.http.HttpClient.newHttpClient();
String token = "eyJ..."; // put your access token here
var req = java.net.http.HttpRequest.newBuilder()
.uri(URI.create("https://api.example.com/resource"))
.header("Authorization", "Bearer " + token)
.header("Content-Type", "application/json")
.POST(java.net.http.HttpRequest.BodyPublishers.ofString("{\"ping\":\"pong\"}"))
.build();
var res = client.send(req, java.net.http.HttpResponse.BodyHandlers.ofString());
System.out.println(res.statusCode() + " " + res.body());
OkHttp (popular + simple)
OkHttpClient client = new OkHttpClient.Builder()
.addInterceptor(chain -> {
String token = "eyJ..."; // inject per request or from a provider
Request req = chain.request().newBuilder()
.addHeader("Authorization", "Bearer " + token)
.build();
return chain.proceed(req);
})
.build();
Request request = new Request.Builder()
.url("https://api.example.com/resource")
.post(RequestBody.create("{\"ping\":\"pong\"}", MediaType.get("application/json")))
.build();
try (Response resp = client.newCall(request).execute()) {
System.out.println(resp.code());
}
Apache HttpClient 5
var httpClient = HttpClients.custom()
.addRequestInterceptorFirst((HttpRequest request, EntityDetails entity, HttpContext ctx) -> {
request.addHeader("Authorization", "Bearer " + "eyJ...");
})
.build();
var post = new HttpPost("https://api.example.com/resource");
post.setHeader(HttpHeaders.CONTENT_TYPE, "application/json");
post.setEntity(new StringEntity("{\"ping\":\"pong\"}", StandardCharsets.UTF_8));
try (var resp = httpClient.execute(post)) {
System.out.println(resp.getCode());
}
Spring (WebClient) — preferred in Spring Boot
@Bean
WebClient webClient() {
return WebClient.builder()
.filter((req, next) -> {
String token = "eyJ..."; // inject from a bean that caches/refreshes
ClientRequest r = ClientRequest.from(req)
.header(HttpHeaders.AUTHORIZATION, "Bearer " + token).build();
return next.exchange(r);
})
.build();
}
// use it
webClient().post().uri("https://api.example.com/resource")
.contentType(MediaType.APPLICATION_JSON)
.bodyValue(Map.of("ping","pong"))
.retrieve().toEntity(String.class).block();
Spring (RestTemplate)
RestTemplate rt = new RestTemplate();
rt.getInterceptors().add((req, body, ex) -> {
req.getHeaders().setBearerAuth("eyJ...");
return ex.execute(req, body);
});
ResponseEntity<String> resp = rt.getForEntity("https://api.example.com/resource", String.class);
Feign (OpenFeign)
@Bean
public RequestInterceptor bearerAuth() {
return template -> template.header("Authorization", "Bearer " + "eyJ...");
}
JAX-WS / SOAP (header example)
SOAP 1.1 often also needs SOAPAction, but the Bearer goes in HTTP headers:
BindingProvider bp = (BindingProvider) port;
Map<String, List<String>> headers = new HashMap<>();
headers.put("Authorization", List.of("Bearer eyJ..."));
bp.getRequestContext().put(MessageContext.HTTP_REQUEST_HEADERS, headers);
Getting the token (Ping/OIDC) in Java (client-credentials)
var client = HttpClient.newHttpClient();
var form = URLEncoder.encode("grant_type","UTF-8") + "=client_credentials" +
"&" + URLEncoder.encode("client_id","UTF-8") + "=" + URLEncoder.encode(System.getenv("OIDC_CLIENT_ID"),"UTF-8") +
"&" + URLEncoder.encode("client_secret","UTF-8") + "=" + URLEncoder.encode(System.getenv("OIDC_CLIENT_SECRET"),"UTF-8");
var req = HttpRequest.newBuilder(URI.create("https://idp.example.com/oauth2/token"))
.header("Content-Type", "application/x-www-form-urlencoded")
.POST(HttpRequest.BodyPublishers.ofString(form))
.build();
var res = client.send(req, HttpResponse.BodyHandlers.ofString());
String token = new org.json.JSONObject(res.body()).getString("access_token");
Pro tips (Kong/Ping friendly)
- Always send
Authorization: Bearer <token>(no quotes, single space). - Handle 401 by refreshing the token (cache
access_token+expires_in). - For Cloudflare/ALB in front, ensure they don’t strip
Authorization. - If you need mTLS as well, add your keystore/truststore to the HTTP client config; the Bearer header stays the same.
If you tell me which client you’re using (Spring WebClient, RestTemplate, OkHttp, Apache, or pure Java 11) and how you obtain tokens (client-credentials vs user flow), I’ll tailor a tiny reusable “TokenProvider” + interceptor for you.
Infra Cloud Solutions 