Token Exchange
An OAuth 2.0 extension (RFC 8693) that exchanges one token for another, enabling delegation and impersonation across services. Increasingly used to scope tokens for downstream APIs and AI agents.
Token exchange is the mechanism that keeps delegation honest across service hops: instead of forwarding a broad token downstream, a service swaps it for a narrower one scoped to the next call, preserving who the original subject was. That property is exactly what agent architectures need, which is why it underpins the 2026 work on standardizing AI agent authorization.
See also: OAuth 2.0, agentic identity, client credentials, what is non-human identity
Related on Start with Identity
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryDevice Authorization Grant
An OAuth 2.0 flow (RFC 8628) for input-constrained devices like TVs and CLIs. The user authorizes on a second device using a short code. Device code flow is the
- GlossaryOpenID Connect (OIDC)
OpenID Connect is an authentication layer built on top of OAuth 2.0. Where OAuth tells you what a token is authorized for, OIDC tells you who the user is via a
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- BlogBlack Hat USA 2026 recap: passkeys get broken (twice), and AI agents get an identity perimeter
Our identity takeaways from Black Hat USA 2026: two independent passkey implementation attacks, a wave of AI agent identity and governance launches, an open sou
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.