diff --git a/examples/kitchen-sink.yaml b/examples/kitchen-sink.yaml
index 3bb08f20..6bf7ef9c 100644
--- a/examples/kitchen-sink.yaml
+++ b/examples/kitchen-sink.yaml
@@ -72,6 +72,14 @@ logger_provider:
             # The value is a list of comma separated key-value pairs matching the format of OTEL_EXPORTER_OTLP_HEADERS. See https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md#configuration-options for details.
             # If omitted or null, no headers are added.
             headers_list: "api-key=1234"
+            # Configure a user provided authenticator.
+            # The authenticator is a component that is loaded like any other components, e.g. custom exporter.
+            # The authenticator is asked to provide authentication headers for each export, so it can be used for
+            # rotating credentials.
+            authenticator:
+              rainy_cloud:
+                tenant: foo
+                region: bar
             # Configure compression.
             # Values include: gzip, none. Implementations may support other compression algorithms.
             # If omitted or null, none is used.
@@ -114,6 +122,14 @@ logger_provider:
             # The value is a list of comma separated key-value pairs matching the format of OTEL_EXPORTER_OTLP_HEADERS. See https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md#configuration-options for details.
             # If omitted or null, no headers are added.
             headers_list: "api-key=1234"
+            # Configure a user provided authenticator.
+            # The authenticator is a component that is loaded like any other components, e.g. custom exporter.
+            # The authenticator is asked to provide authentication headers for each export, so it can be used for
+            # rotating credentials.
+            authenticator:
+              rainy_cloud:
+                tenant: foo
+                region: bar
             # Configure compression.
             # Values include: gzip, none. Implementations may support other compression algorithms.
             # If omitted or null, none is used.
@@ -294,6 +310,14 @@ meter_provider:
             # The value is a list of comma separated key-value pairs matching the format of OTEL_EXPORTER_OTLP_HEADERS. See https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md#configuration-options for details.
             # If omitted or null, no headers are added.
             headers_list: "api-key=1234"
+            # Configure a user provided authenticator.
+            # The authenticator is a component that is loaded like any other components, e.g. custom exporter.
+            # The authenticator is asked to provide authentication headers for each export, so it can be used for
+            # rotating credentials.
+            authenticator:
+              rainy_cloud:
+                tenant: foo
+                region: bar
             # Configure compression.
             # Values include: gzip, none. Implementations may support other compression algorithms.
             # If omitted or null, none is used.
@@ -375,6 +399,14 @@ meter_provider:
             # The value is a list of comma separated key-value pairs matching the format of OTEL_EXPORTER_OTLP_HEADERS. See https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md#configuration-options for details.
             # If omitted or null, no headers are added.
             headers_list: "api-key=1234"
+            # Configure a user provided authenticator.
+            # The authenticator is a component that is loaded like any other components, e.g. custom exporter.
+            # The authenticator is asked to provide authentication headers for each export, so it can be used for
+            # rotating credentials.
+            authenticator:
+              rainy_cloud:
+                tenant: foo
+                region: bar
             # Configure compression.
             # Values include: gzip, none. Implementations may support other compression algorithms.
             # If omitted or null, none is used.
@@ -606,6 +638,14 @@ tracer_provider:
             # The value is a list of comma separated key-value pairs matching the format of OTEL_EXPORTER_OTLP_HEADERS. See https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md#configuration-options for details.
             # If omitted or null, no headers are added.
             headers_list: "api-key=1234"
+            # Configure a user provided authenticator.
+            # The authenticator is a component that is loaded like any other components, e.g. custom exporter.
+            # The authenticator is asked to provide authentication headers for each export, so it can be used for
+            # rotating credentials.
+            authenticator:
+              rainy_cloud:
+                tenant: foo
+                region: bar
             # Configure compression.
             # Values include: gzip, none. Implementations may support other compression algorithms.
             # If omitted or null, none is used.
@@ -648,6 +688,14 @@ tracer_provider:
             # The value is a list of comma separated key-value pairs matching the format of OTEL_EXPORTER_OTLP_HEADERS. See https://github.com/open-telemetry/opentelemetry-specification/blob/main/specification/protocol/exporter.md#configuration-options for details.
             # If omitted or null, no headers are added.
             headers_list: "api-key=1234"
+            # Configure a user provided authenticator.
+            # The authenticator is a component that is loaded like any other components, e.g. custom exporter.
+            # The authenticator is asked to provide authentication headers for each export, so it can be used for
+            # rotating credentials.
+            authenticator:
+              rainy_cloud:
+                tenant: foo
+                region: bar
             # Configure compression.
             # Values include: gzip, none. Implementations may support other compression algorithms.
             # If omitted or null, none is used.
diff --git a/schema/common.json b/schema/common.json
index 5a943d53..16dc0fec 100644
--- a/schema/common.json
+++ b/schema/common.json
@@ -60,6 +60,9 @@
                 "headers_list": {
                     "type": ["string", "null"]
                 },
+                "authenticator": {
+                    "$ref": "#/$defs/Authenticator"
+                },
                 "compression": {
                     "type": ["string", "null"]
                 },
@@ -104,6 +107,9 @@
                 "headers_list": {
                     "type": ["string", "null"]
                 },
+                "authenticator": {
+                    "$ref": "#/$defs/Authenticator"
+                },
                 "compression": {
                     "type": ["string", "null"]
                 },
@@ -128,6 +134,17 @@
         "ConsoleExporter": {
             "type": ["object", "null"],
             "additionalProperties": false
+        },
+        "Authenticator": {
+            "type": "object",
+            "additionalProperties": true,
+            "minProperties": 1,
+            "maxProperties": 1,
+            "patternProperties": {
+                ".*": {
+                    "type": ["object"]
+                }
+            }
         }
     }
-}
\ No newline at end of file
+}
diff --git a/schema/meter_provider.json b/schema/meter_provider.json
index bc1e9210..f71552b0 100644
--- a/schema/meter_provider.json
+++ b/schema/meter_provider.json
@@ -263,6 +263,9 @@
                 "headers_list": {
                     "type": ["string", "null"]
                 },
+                "authenticator": {
+                    "$ref": "common.json#/$defs/Authenticator"
+                },
                 "compression": {
                     "type": ["string", "null"]
                 },
@@ -306,6 +309,9 @@
                 "headers_list": {
                     "type": ["string", "null"]
                 },
+                "authenticator": {
+                    "$ref": "common.json#/$defs/Authenticator"
+                },
                 "compression": {
                     "type": ["string", "null"]
                 },
diff --git a/schema/resource.json b/schema/resource.json
index ca8add58..6bf09ac8 100644
--- a/schema/resource.json
+++ b/schema/resource.json
@@ -81,7 +81,7 @@
             "additionalProperties": true,
             "minProperties": 1,
             "maxProperties": 1,
-            "properties": {
+            "patternProperties": {
                 "container": {
                     "$ref": "#/$defs/ExperimentalContainerResourceDetector"
                 },
@@ -93,9 +93,7 @@
                 },
                 "service": {
                     "$ref": "#/$defs/ExperimentalServiceResourceDetector"
-                }
-            },
-            "patternProperties": {
+                },
                 ".*": {
                     "type": ["object", "null"]
                 }