static String formatAuthorizationHeader(String clientId, String clientSecret, boolean urlencode) throws
        UnsupportedEncodingException {
        clientId = sanitizeString("the token endpoint request client ID parameter", clientId);
        clientSecret = sanitizeString("the token endpoint request client secret parameter", clientSecret);

        // according to RFC-6749 clientId & clientSecret must be urlencoded, see https://tools.ietf.org/html/rfc6749#section-2.3.1
        if (urlencode) {
            clientId = URLEncoder.encode(clientId, StandardCharsets.UTF_8.name());
            clientSecret = URLEncoder.encode(clientSecret, StandardCharsets.UTF_8.name());
        }

        String s = String.format("%s:%s", clientId, clientSecret);
        // Per RFC-7617, we need to use the *non-URL safe* base64 encoder. See KAFKA-14496.
        String encoded = Base64.getEncoder().encodeToString(Utils.utf8(s));
        return String.format("Basic %s", encoded);
    }
Retrieves a JWT access token in its serialized three-part form. The implementation
is free to determine how it should be retrieved but should not perform validation
on the result.

<b>Note</b>: This is a blocking function and callers should be aware that the
implementation communicates over a network. The facility in the
{@link javax.security.auth.spi.LoginModule} from which this is ultimately called
does not provide an asynchronous approach.

@return Non-<code>null</code> JWT access token string

@throws IOException Thrown on errors related to IO during retrieval
clients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/secured/HttpAccessTokenRetriever.java