Bug: [FEATURE]: add client_auth auth type for list_blocked_payment_methods




diff --git a/crates/api_models/src/blocklist.rs b/crates/api_models/src/blocklist.rs
index 2afeb2db4f6..9fb537b226f 100644
--- a/crates/api_models/src/blocklist.rs
+++ b/crates/api_models/src/blocklist.rs
@@ -53,6 +53,7 @@ pub struct ListBlocklistQuery {
     pub limit: u16,
     #[serde(default)]
     pub offset: u16,
+    pub client_secret: Option<String>,
 }
 
 fn default_list_limit() -> u16 {
diff --git a/crates/router/src/routes/blocklist.rs b/crates/router/src/routes/blocklist.rs
index 9e6a7eca30a..be4e81afc3f 100644
--- a/crates/router/src/routes/blocklist.rs
+++ b/crates/router/src/routes/blocklist.rs
@@ -1,5 +1,6 @@
 use actix_web::{web, HttpRequest, HttpResponse};
 use api_models::blocklist as api_blocklist;
+use error_stack::report;
 use router_env::Flow;
 
 use crate::{
@@ -117,11 +118,24 @@ pub async fn list_blocked_payment_methods(
     query_payload: web::Query<api_blocklist::ListBlocklistQuery>,
 ) -> HttpResponse {
     let flow = Flow::ListBlocklist;
+    let payload = query_payload.into_inner();
+
+    let api_auth = auth::ApiKeyAuth {
+        is_connected_allowed: false,
+        is_platform_allowed: false,
+    };
+
+    let (auth_type, _) =
+        match auth::check_client_secret_and_get_auth(req.headers(), &payload, api_auth) {
+            Ok(auth) => auth,
+            Err(err) => return api::log_and_return_error_response(report!(err)),
+        };
+
     Box::pin(api::server_wrap(
         flow,
         state,
         &req,
-        query_payload.into_inner(),
+        payload,
         |state, auth: auth::AuthenticationData, query, _| {
             let merchant_context = domain::MerchantContext::NormalMerchant(Box::new(
                 domain::Context(auth.merchant_account, auth.key_store),
@@ -129,10 +143,7 @@ pub async fn list_blocked_payment_methods(
             blocklist::list_blocklist_entries(state, merchant_context, query)
         },
         auth::auth_type(
-            &auth::HeaderAuth(auth::ApiKeyAuth {
-                is_connected_allowed: false,
-                is_platform_allowed: false,
-            }),
+            &*auth_type,
             &auth::JWTAuth {
                 permission: Permission::MerchantAccountRead,
             },
diff --git a/crates/router/src/services/authentication.rs b/crates/router/src/services/authentication.rs
index 1e48e9e52b1..851c2cf21b9 100644
--- a/crates/router/src/services/authentication.rs
+++ b/crates/router/src/services/authentication.rs
@@ -4161,6 +4161,13 @@ impl ClientSecretFetch for payments::PaymentsRequest {
     }
 }
 
+#[cfg(feature = "v1")]
+impl ClientSecretFetch for api_models::blocklist::ListBlocklistQuery {
+    fn get_client_secret(&self) -> Option<&String> {
+        self.client_secret.as_ref()
+    }
+}
+
 #[cfg(feature = "v1")]
 impl ClientSecretFetch for payments::PaymentsRetrieveRequest {
     fn get_client_secret(&self) -> Option<&String> {

## Type of Change
<!-- Put an `x` in the boxes that apply -->

- [ ] Bugfix
- [ ] New feature
- [x] Enhancement
- [ ] Refactoring
- [ ] Dependency updates
- [ ] Documentation
- [ ] CI/CD

## Description
add client_secret auth auth type for list_blocked_payment_methods

### Additional Changes

- [ ] This PR modifies the API contract
- [ ] This PR modifies the database schema
- [ ] This PR modifies application configuration/environment variables

<!--
Provide links to the files with corresponding changes.

Following are the paths where you can find config files:
1. `config`
2. `crates/router/src/configs`
3. `loadtest/config`
-->


## Motivation and Context
<!--
Why is this change required? What problem does it solve?
If it fixes an open issue, please link to the issue here.

If you don't have an issue, we'd recommend starting with one first so the PR
can focus on the implementation (unless it is an obvious bug or documentation fix
that will have little conversation).
-->


## How did you test it?
1. create a blocklist
```
curl --location 'http://localhost:8080/blocklist' \
--header 'Content-Type: application/json' \
--header 'api-key: ______' \
--data '{
    "type": "card_bin",
    "data": "424242"
}'
```
Response
```
{
    "fingerprint_id": "424242",
    "data_kind": "card_bin",
    "created_at": "2025-09-22T11:25:25.775Z"
}
```


2. List using client secret
```
curl --location 'http://localhost:8080/blocklist?data_kind=card_bin&client_secret=______' \
--header 'api-key: ____'
```

Response
```
[
    {
        "fingerprint_id": "424242",
        "data_kind": "card_bin",
        "created_at": "2025-09-22T11:25:25.775Z"
    }
]
```


## Checklist
<!-- Put an `x` in the boxes that apply -->

- [x] I formatted the code `cargo +nightly fmt --all`
- [x] I addressed lints thrown by `cargo clippy`
- [x] I reviewed the submitted code
- [ ] I added unit tests for my changes where possible
