How would you handle complex OAuth 2.0 / OIDC flows in Karate?

Client credentials flow — straightforward:

# helpers/get-token-cc.feature
Scenario:
  * url tokenUrl
  Given path '/oauth/token'
  And   form field grant_type    = 'client_credentials'
  And   form field client_id     = clientId
  And   form field client_secret = clientSecret
  And   form field scope         = 'api:read api:write'
  When  method POST
  Then  status 200
  * def accessToken = response.access_token
  * def expiresIn   = response.expires_in

In karate-config.js — fetch once per suite:

var auth = karate.callSingle('classpath:helpers/get-token-cc.feature', config);
config.bearerToken = auth.accessToken;

Resource Owner Password Credentials (test-only grant):

And   form field grant_type = 'password'
And   form field username   = testUsername
And   form field password   = testPassword

PKCE / Authorization Code — harder without a browser: Karate can't automate the browser redirect natively. Two options:

1. Use a Karate Mock Server to capture the redirect and exchange the code programmatically
2. Use a dedicated library (Playwright for the auth flow) and hand the token to Karate via a system property or shared file

Token refresh: use a JavaScript helper that checks expiresAt - 60s before each feature and re-calls the token feature if needed, injecting the new token via karate.set('bearerToken', newToken).