Make DefaultHttpClient extensible

Checklist

I have looked into the Readme and Examples, and have not found a suitable solution or answer.
I have looked into the API documentation and have not found a suitable solution or answer.
I have searched the issues and have not found a suitable solution or answer.
I have searched the Auth0 Community forums and have not found a suitable solution or answer.
I agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

We use OkHttp as our client across our codebase and share common default configuration. We would like to re-use this configuration in our use of the Auth0 client without having to implement the whole Auth0HttpClient contract.

Describe the ideal solution

Make the following constructor protected instead of package scoped.

DefaultHttpClient(OkHttpClient client) {
        this.client = client;
    }

Alternatives and current workarounds

For us to solve this, the only alternative we can see is to fully implement the Auth0HttpClient contract. This would basically be copy-pasting from the DefaultHttpClient implementation in the SDK.

An alternative to the attached PR solution would be to build out DefaultHttpClient.Builder with more-and-more of the configurations that the OkHttp library supports (dispatcher executor service, etc) to cover our use case. This seems unattractive as if you follow that approach fully you end up with a copy of what the OkHttp client builder exposes.

Additional context

No response

Make DefaultHttpClient extensible, Issue auth0#754

Associated PR: #755

@noetro

Hi @noetro

Thank you for your detailed explanation!!

We understand your use case, but we are intentionally keeping the DefaultHttpClient constructor package-private to encourage the use of our builder pattern. This helps ensure instances are created in a consistent manner. Opening the constructor, even as protected increases the risk of unintended usage.

However, we can look for other solutions. We’ll evaluate this further to see if it can provide the flexibility, without compromising the integrity of the SDK’s design.

Thanks again for raising this issue.

@noetro

Hi @noetro,

Happy to share that this is now resolved in 5.4.0 🎉

As noted earlier, we wanted to keep the DefaultHttpClient constructor package-private so instances are always created through the builder. Instead of opening the constructor, we added DefaultHttpClient.Builder.withClient(OkHttpClient), which lets you reuse an existing OkHttpClient as the base:

OkHttpClient okHttpClient = new OkHttpClient.Builder()                                                                                                                                                   
          // your shared transport configuration (timeouts, dispatcher, interceptors, etc.)                                                                                                                
          .build();                                                                                                                                                                                        
                                                                                                                                                                                                           
Auth0HttpClient httpClient = DefaultHttpClient.newBuilder()                                                                                                                                              
        .withClient(okHttpClient)                                                                                                                                                                        
        .build();                                                                                                                                                                                        
                                                                                                                                                                                                           
AuthAPI auth = AuthAPI.newBuilder("{YOUR_DOMAIN}", "{YOUR_CLIENT_ID}", "{YOUR_CLIENT_SECRET}")                                                                                                           
        .withHttpClient(httpClient)                                                                                                                                                                      
        .build();

When you supply a client, it owns the full transport configuration (timeouts, dispatcher, connection pool, proxy, and its own interceptors), the builder's transport setters are ignored so nothing is silently overridden. The SDK still layers its telemetry, rate-limit, and logging behavior on top, so those guarantees always hold.

This gives you full control over the networking stack through your own OkHttpClient without exposing the constructor or compromising the builder-driven design. See the HTTP Client configuration section in EXAMPLES.md for details.

Thanks again for raising this, closing as resolved. 🙏

Navigation Menu

Repository navigation

Make DefaultHttpClient extensible #754

Checklist

Describe the problem you'd like to have solved

Describe the ideal solution

Alternatives and current workarounds

Additional context

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Make DefaultHttpClient extensible #754

Description

Checklist

Describe the problem you'd like to have solved

Describe the ideal solution

Alternatives and current workarounds

Additional context

Activity

noetro commented on Aug 25, 2025

tanya732 commented on Sep 9, 2025

tanya732 commented on Oct 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions