Token Exchange
An OAuth 2.0 extension protocol defined in RFC 8693 that allows a client to obtain a new token scoped to a specific downstream service by submitting an existing token. It is commonly used for secure authorization propagation in multi-hop call chains.
Timeline (last 90 days)
The Token Exchange specification in the OAuth 2.0 framework (RFC 8693) allows an authenticated principal to delegate a portion of its permissions to another entity while retaining authorization chain provenance information.
There are two mainstream patterns for propagating original authorization information in multi-hop call chains: token passthrough and exchanging for a new token via OAuth 2.0 Token Exchange (RFC 8693).
The actor (act) claim is retained in the Token Exchange payload to preserve provenance information.
The Token Exchange pattern completely eliminates the identity impersonation problem present in pattern four, achieving full observability of the user, the agent, and the operations permitted by both parties.
The Token Exchange and 'On Behalf Of' delegation mechanism requires the agent to authenticate itself, enabling the system to authenticate both the user and the agent simultaneously and making it explicit that the agent is performing operations on behalf of the user.
Each time an identity is passed downstream, the scope defined during token exchange should restrict rather than expand permissions, following the principle of least privilege.
The second layer of the two-layer access model is built on a Token Exchange mechanism, whereby the Agent uses the delegated token to dynamically exchange access tokens for target applications through the identity provider, rather than pre-storing credentials for all applications.
All Facts (7)
The Token Exchange specification in the OAuth 2.0 framework (RFC 8693) allows an authenticated principal to delegate a portion of its permissions to another entity while retaining authorization chain provenance information.
50%UnverifiedThere are two mainstream patterns for propagating original authorization information in multi-hop call chains: token passthrough and exchanging for a new token via OAuth 2.0 Token Exchange (RFC 8693).
50%UnverifiedThe actor (act) claim is retained in the Token Exchange payload to preserve provenance information.
50%UnverifiedThe Token Exchange pattern completely eliminates the identity impersonation problem present in pattern four, achieving full observability of the user, the agent, and the operations permitted by both parties.
50%UnverifiedThe Token Exchange and 'On Behalf Of' delegation mechanism requires the agent to authenticate itself, enabling the system to authenticate both the user and the agent simultaneously and making it explicit that the agent is performing operations on behalf of the user.
50%UnverifiedEach time an identity is passed downstream, the scope defined during token exchange should restrict rather than expand permissions, following the principle of least privilege.
50%UnverifiedThe second layer of the two-layer access model is built on a Token Exchange mechanism, whereby the Agent uses the delegated token to dynamically exchange access tokens for target applications through the identity provider, rather than pre-storing credentials for all applications.
50%