[Feature]: Upstream Oauth2 Authentication policy

[Thenujan-Nagaratnam]

Please select the area the issue is related to

Gateway

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI)

Suggested Feature

Our AI Gateway currently supports only API Key authentication from the Gateway to the LLM. But many LLM providers now expect OAuth2 support.

Add an oauth2 upstream-auth option so the gateway can authenticate to an behind a corporate OAuth2 proxy, etc.) as a confidential client — exchanging credentials for a short-lived access token and injecting it as Authorization: Bearer <token> — instead of only the existing static pre-shared API key.

Related Issues

No response

Steps to Verify

• Design Document — A detailed design document has been created and reviewed, covering architecture, data flow, and edge cases.
• Design Mail — A design summary email has been sent to relevant stakeholders for awareness and feedback.
• Code Review — All code changes have been peer-reviewed and approved according to the project's review standards.
• Testing Complete — Adequate unit, integration, and/or end-to-end tests have been written and are passing.
• Documentation Review — User-facing and/or developer documentation has been updated to reflect the new feature and reviewed.
• Feature Complete — The feature is fully implemented, all checklist items above are done, and it is ready for release.