# token-exchange

Source: https://startwithidentity.com/glossary/token-exchange/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

An OAuth 2.0 extension (RFC 8693) that exchanges one token for another, enabling delegation and impersonation across services. Increasingly used to scope tokens for downstream APIs and AI agents.

Token exchange is the mechanism that keeps delegation honest across service hops: instead of forwarding a broad token downstream, a service swaps it for a narrower one scoped to the next call, preserving who the original subject was. That property is exactly what agent architectures need, which is why it underpins the 2026 work on standardizing AI agent authorization.

See also: [OAuth 2.0](https://startwithidentity.com/standards/oauth-2-0/), [agentic identity](https://startwithidentity.com/glossary/agentic-identity/), [client credentials](https://startwithidentity.com/glossary/client-credentials/), [what is non-human identity](https://startwithidentity.com/guides/fundamentals/what-is-non-human-identity/)