fix: forward plain-string headers to token fetch request

src/management/wrapper/token-provider.ts

@@ -16,7 +16,13 @@ export class TokenProvider {
     constructor(
         private readonly options: ManagementClient.ManagementClientOptionsWithClientCredentials & { audience: string },
     ) {
-        this.authenticationClient = new AuthenticationClient({ ...options, headers: undefined });
+        const stringHeaders = options.headers
+            ? (Object.fromEntries(Object.entries(options.headers).filter(([, v]) => typeof v === "string")) as Record<
+                  string,
+                  string
+              >)
+            : undefined;
+        this.authenticationClient = new AuthenticationClient({ ...options, headers: stringHeaders });
     }
 
     public async getAccessToken() {

tests/management/token-provider.test.ts

@@ -122,6 +122,52 @@ describe("TokenProvider", () => {
         expect(spy).toHaveBeenCalledTimes(1);
     });
 
+    it("should forward plain string headers to the token fetch request", async () => {
+        const domain = "headers-test.auth0.com";
+        const customUserAgent = "my-custom-sdk/1.0";
+
+        const headerSpy = jest.fn().mockReturnValue({
+            access_token: "my-access-token",
+            expires_in: 86400,
+            token_type: "Bearer",
+        });
+
+        nock(`https://${domain}`).post("/oauth/token").matchHeader("user-agent", customUserAgent).reply(200, headerSpy);
+
+        const tp = new TokenProvider({
+            ...opts,
+            domain,
+            headers: { "User-Agent": customUserAgent },
+        });
+
+        expect(await tp.getAccessToken()).toBe("my-access-token");
+        expect(headerSpy).toHaveBeenCalled();
+    });
+
+    it("should not throw when headers contain non-string values (supplier functions filtered out)", async () => {
+        const domain = "supplier-headers-test.auth0.com";
+
+        const supplierSpy = jest.fn().mockReturnValue({
+            access_token: "my-access-token",
+            expires_in: 86400,
+            token_type: "Bearer",
+        });
+
+        nock(`https://${domain}`).post("/oauth/token").reply(200, supplierSpy);
+
+        const tp = new TokenProvider({
+            ...opts,
+            domain,
+            headers: {
+                "User-Agent": "plain-string",
+                "X-Dynamic": () => "supplier-value",
+            } as any,
+        });
+
+        await expect(tp.getAccessToken()).resolves.toBe("my-access-token");
+        expect(supplierSpy).toHaveBeenCalled();
+    });
+
     it.skip("should use a custom fetch", async () => {
         const customFetch = jest
             .fn<FetchAPI>()