# OAuth2 fixture

`OAuth2Fixture` exposes a token endpoint backed by the same deterministic fixture server as the rest
of the suite.

It counts token requests, which is what makes design §20.3's single-flight guarantee provable rather
than assumed: a hundred genuinely concurrent callers must produce exactly one token request. It can
also issue rotating token values, so a stale cached token is detectable, and queue a failure status
to exercise the refresh-failure path.

The token endpoint is configured as its own Named Client Profile, separate from the upstream it
issues tokens for.