authentication – Can a proxy like Envoy or NGINX do a pre-request to get an auth token via client credential exchange and then inject the token into the request?

I have a scenario where we’re looking to remove an integration platform from our ecosystem. The reason is due to costs.

One of the specific integrations that we need to replace has a few things we need to consider including:

1. The destination requires IP whitelisting, but the source doesn’t have a consistent set of static IPs that we can whitelist.
2. It would be quite difficult to make the source platform handle the authentication request and then add the authorization HTTP header to the destination request.
3. For this particular integration, the integration platform was first making an (OAuth) authentication request to get an access token (using client credential flow). The access token was then added to the authorization HTTP header of the request to the destination.

To deal with #1, we were looking to proxy requests to a proxy service running in AWS where outbound requests will egress via a NATG with static IPs that we own. We were considering using something like Envoy or NGINX as the proxy.

Is it possible to configure Envoy or NGINX (or some other proxy) to make an authentication pre-request to an OAuth authorization server using client credential exchange, and then add the resultant token to the authorization HTTP header of the request to the destination?