fix: send sage_intacct oauth client credentials in the request body (#10685)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/oauth_connect.json

@@ -159,7 +159,8 @@
   "sage_intacct": {
     "auth_url": "https://api.intacct.com/ia/api/v1/oauth2/authorize",
     "token_url": "https://api.intacct.com/ia/api/v1/oauth2/token",
-    "scopes": ["offline_access"]
+    "scopes": ["offline_access"],
+    "req_body_auth": true
   },
   "spotify": {
     "auth_url": "https://accounts.spotify.com/authorize",

backend/windmill-oauth/src/lib.rs

@@ -1179,6 +1179,18 @@ mod tests {
         assert!(verifier.verify("123", "body", "wrong_sig").is_err());
     }
 
+    // Sage Intacct's token endpoint rejects HTTP Basic client authentication on the
+    // refresh_token grant (`invalid_client`), so its credentials must go in the form body.
+    #[test]
+    fn sage_intacct_registry_entry_uses_request_body_client_auth() {
+        let registry: HashMap<String, OAuthConfig> =
+            serde_json::from_str(include_str!("../../oauth_connect.json")).unwrap();
+        assert_eq!(
+            registry.get("sage_intacct").unwrap().req_body_auth,
+            Some(true)
+        );
+    }
+
     #[test]
     fn canonical_provider_name_strips_sandbox_suffix() {
         assert_eq!(canonical_provider_name("docusign_sandbox"), "docusign");