Token Exchange (RFC 8693)

In a microservices world, Service A receives a token from a user, then must call Service B on the user's behalf. Forwarding the original token everywhere is risky — it may have the wrong audience or too-broad scopes.

Token Exchange (RFC 8693) lets a service trade an incoming token for a new, narrower or differently-scoped token from the authorization server.

Two distinct patterns:

• Impersonation — the new token looks like it belongs purely to the user; downstream cannot tell a middle service was involved.
• Delegation — the new token records both the user and the acting service via an act claim, preserving the chain.

Token Exchange defines a new grant type sent to the standard token endpoint:

urn:ietf:params:oauth:grant-type:token-exchange

It does not need a browser or user interaction — it is a direct back-channel call.

The request uses several parameters:

• subject_token + subject_token_type — the token to exchange.
• actor_token — optional, identifies the acting party.
• audience / resource — the target service.
• scope — requested scopes for the new token.

Token types are identified by URIs, for example:

• urn:ietf:params:oauth:token-type:access_token
• urn:ietf:params:oauth:token-type:jwt
• urn:ietf:params:oauth:token-type:id_token

Service A exchanges the user's access token for a token scoped to Service B:

The response includes the new token plus an issued_token_type telling the caller what it received.

In delegation mode, the issued JWT contains an act (actor) claim nesting the acting party inside the subject. This lets the resource server audit who acted on whose behalf.

A powerful use is downscoping: a service holding a broad token exchanges it for one with fewer scopes before passing it downstream. This honors least privilege so a compromised downstream service cannot do more than it needs.

Reach for Token Exchange when:

• Crossing trust or audience boundaries between services.
• You need an auditable delegation chain.
• You want to narrow scopes for downstream calls.

Avoid blindly forwarding the original token across services.

The authorization server must authenticate the requesting client and verify it is permitted to exchange the subject token for the requested audience. Always set a correct aud so tokens cannot be replayed against other services.

Token Exchange (RFC 8693) trades one token for another via grant type token-exchange.

• Supports impersonation and delegation (the act claim).
• Lets services downscope and re-audience tokens for downstream calls.
• Requires the AS to authenticate the client and validate the target audience.