Identity Chaining
Identity chaining is an OAuth 2.0 mechanism, defined in the IETF draft OAuth Identity and Authorization Chaining Across Domains (draft-ietf-oauth-identity-chaining), that preserves who the user is and what was authorized when a request crosses from one trust domain to another, by combining Token Exchange (RFC 8693) inside the first domain with a JWT authorization grant (RFC 7523) in the second. As of October 2026 the draft has been approved by the IESG and sits in the RFC Editor queue: it is not yet published as an RFC and has no RFC number.
The pattern repeats at every boundary: the client asks its own authorization server for a JWT grant aimed at the other domain, then redeems that grant at the other domain's authorization server for a local access token. Each hop can narrow scope and audience, and the subject survives the trip instead of being replaced by a shared service credential. It is the base layer for ID-JAG and Cross App Access, which profile it for the enterprise IdP case, and it is the most likely standard answer for AI agents that call APIs in another company's domain.
See also: token exchange, ID-JAG, Cross App Access, transaction tokens, federation, OAuth 2.0, agent identity standards map 2026
Related on Start with Identity
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryIdentity Provider (IdP)
A system that authenticates users and issues assertions or tokens vouching for their identity to other applications. In federated single sign-on, the identity p
- GlossarySocial Login
Letting users sign in with an existing account from a provider like Google or Apple, usually over OIDC. Reduces signup friction but ties accounts to third-party