Token Exchange
An OAuth 2.0 extension (RFC 8693) that exchanges one token for another, enabling delegation and impersonation across services. Increasingly used to scope tokens for downstream APIs and AI agents.
Token exchange is the mechanism that keeps delegation honest across service hops: instead of forwarding a broad token downstream, a service swaps it for a narrower one scoped to the next call, preserving who the original subject was. That property is exactly what agent architectures need, which is why it underpins the 2026 work on standardizing AI agent authorization.
See also: OAuth 2.0, agentic identity, client credentials, what is non-human identity, ID-JAG, identity chaining, transaction tokens, delegation chain, ID-JAG and Cross App Access
Related on Start with Identity
- GlossaryMCP Authorization
MCP authorization is the part of the [Model Context Protocol specification](https://modelcontextprotocol.io/specification/latest/basic/authorization) that defin
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryAuthorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorizatio
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- BlogBlack Hat USA 2026 recap: passkeys get broken (twice), and AI agents get an identity perimeter
Our identity takeaways from Black Hat USA 2026: two independent passkey implementation attacks, a wave of AI agent identity and governance launches, an open sou