From 583bd3ac8b23ae3435c56a707fa9498b3d177cad Mon Sep 17 00:00:00 2001
From: nojaf <florian.verdonck@outlook.com>
Date: Mon, 19 Jan 2026 17:27:34 +0100
Subject: [PATCH] chore: add changeset for elasticsearch auth extension point

Signed-off-by: nojaf <florian.verdonck@outlook.com>
---
 .../elasticsearch-auth-extension-point.md     | 40 +++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 .changeset/elasticsearch-auth-extension-point.md

diff --git a/.changeset/elasticsearch-auth-extension-point.md b/.changeset/elasticsearch-auth-extension-point.md
new file mode 100644
index 0000000000..6ece6c4451
--- /dev/null
+++ b/.changeset/elasticsearch-auth-extension-point.md
@@ -0,0 +1,40 @@
+---
+'@backstage/plugin-search-backend-module-elasticsearch': minor
+---
+
+Added `elasticsearchAuthExtensionPoint` to enable dynamic authentication mechanisms such as bearer tokens with automatic rotation.
+
+This extension point allows adopters to provide custom auth providers that inject headers per-request, enabling:
+
+- Bearer token authentication
+- Automatic token rotation
+- Integration with corporate identity providers
+
+**Example usage:**
+
+```typescript
+import { createBackendModule } from '@backstage/backend-plugin-api';
+import { elasticsearchAuthExtensionPoint } from '@backstage/plugin-search-backend-module-elasticsearch';
+
+export default createBackendModule({
+  pluginId: 'search',
+  moduleId: 'elasticsearch-custom-auth',
+  register(env) {
+    env.registerInit({
+      deps: {
+        elasticsearchAuth: elasticsearchAuthExtensionPoint,
+      },
+      async init({ elasticsearchAuth }) {
+        elasticsearchAuth.setAuthProvider({
+          async getAuthHeaders() {
+            const token = await myTokenService.getToken();
+            return { Authorization: `Bearer ${token}` };
+          },
+        });
+      },
+    });
+  },
+});
+```
+
+The auth provider takes precedence over static auth config when set. Note: AWS provider (SigV4) does not support custom auth providers.