feat: Dpop secure credentials manager

[pmathew92]

Changes

This PR adds the option to pass an instance of AuthenticationAPIClient to the SecureCredentialsManager class. This allows the user to have customisation options for the AuthenticationAPIClient class.
This change also fixes the issue of DPoP not working when being used with SecureCredentialsManager

Checklist

• I have read the Auth0 general contribution guidelines

• I have read the Auth0 Code of Conduct

• All existing and new tests complete without errors

[pmathew92]

@claude

[github-actions]

Claude finished @pmathew92's task —— View job

---

Code Review Complete

• Read PR diff and understand changes
• Read project architecture documentation
• Review code quality
• Review security implications
• Review performance considerations
• Provide inline feedback
• Post overall assessment

Overall Assessment

✅ This pull request is ready to be merged. The implementation successfully adds support for custom AuthenticationAPIClient configuration in SecureCredentialsManager, enabling DPoP functionality. The changes follow existing patterns, maintain backward compatibility, and include comprehensive documentation updates.

---

Job Run | Branch

[Copilot]

Pull Request Overview

This PR enables DPoP support for SecureCredentialsManager by allowing users to pass a custom AuthenticationAPIClient instance to the manager's constructors. This addresses the limitation where DPoP configuration was not possible when using SecureCredentialsManager.

Key changes:

• Added two new public constructors to SecureCredentialsManager that accept a custom AuthenticationAPIClient parameter
• Refactored existing constructors to delegate to new constructors
• Removed unused imports and corrected a typo in documentation

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
SecureCredentialsManager.kt	Added new constructors accepting custom AuthenticationAPIClient for basic and biometric authentication scenarios; removed unused imports; applied minor code formatting improvements
CredentialsManager.kt	Cleaned up unused imports (Base64, OptionalCredentials, SecureCredentialsManager.KEY_CREDENTIALS) and made import statements more specific
EXAMPLES.md	Corrected spelling of "Possession" in DPoP description; added comprehensive documentation and code examples for using custom AuthenticationAPIClient with SecureCredentialsManager

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.