From 39e41250e950722dabc5dc63d11bd7d0b6cf1d0e Mon Sep 17 00:00:00 2001
From: Matheus Cruz <matheuscruz.dev@gmail.com>
Date: Wed, 2 Sep 2026 06:33:01 -0300
Subject: [PATCH]     Execute JaxRSAccessTokenProvider#validateAndGet async

    Token validation and fetching were running synchronously on the
    caller's thread, blocking it during the OAuth2 token request. Wrap
    the work in CompletableFuture.supplyAsync using the workflow's
    executorService so it runs off the calling thread.

Signed-off-by: Matheus Cruz <matheuscruz.dev@gmail.com>
---
 .../http/auth/JaxRSAccessTokenProvider.java   | 28 +++++++++++--------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/impl/http/src/main/java/io/serverlessworkflow/impl/executors/http/auth/JaxRSAccessTokenProvider.java b/impl/http/src/main/java/io/serverlessworkflow/impl/executors/http/auth/JaxRSAccessTokenProvider.java
index 330ebb23d..f67c08fc0 100644
--- a/impl/http/src/main/java/io/serverlessworkflow/impl/executors/http/auth/JaxRSAccessTokenProvider.java
+++ b/impl/http/src/main/java/io/serverlessworkflow/impl/executors/http/auth/JaxRSAccessTokenProvider.java
@@ -57,18 +57,22 @@ class JaxRSAccessTokenProvider implements AccessTokenProvider {
 
   public CompletableFuture<JWT> validateAndGet(
       WorkflowContext workflow, TaskContext context, WorkflowModel model) {
-    Map<String, Object> token = invoke(workflow, context, model);
-    JWT jwt = jwtConverter.fromToken((String) token.get("access_token"));
-    if (issuers != null && !issuers.isEmpty()) {
-      jwt.issuer()
-          .ifPresent(
-              issuer -> {
-                if (!issuers.contains(issuer)) {
-                  throw new IllegalStateException("Token issuer is not valid: " + issuer);
-                }
-              });
-    }
-    return CompletableFuture.completedFuture(jwt);
+    return CompletableFuture.supplyAsync(
+        () -> {
+          Map<String, Object> token = invoke(workflow, context, model);
+          JWT jwt = jwtConverter.fromToken((String) token.get("access_token"));
+          if (issuers != null && !issuers.isEmpty()) {
+            jwt.issuer()
+                .ifPresent(
+                    issuer -> {
+                      if (!issuers.contains(issuer)) {
+                        throw new IllegalStateException("Token issuer is not valid: " + issuer);
+                      }
+                    });
+          }
+          return jwt;
+        },
+        workflow.definition().application().executorService());
   }
 
   private Map<String, Object> invoke(