Transaction Tokens (Txn-Tokens)
Transaction Tokens (Txn-Tokens) are short-lived, signed JWTs, defined in the IETF draft draft-ietf-oauth-transaction-tokens, that carry the user identity, workload identity, and authorization context of one external request through every internal service that processes it inside a single trust domain. As of October 2026 the draft is an IETF OAuth Working Group document in the "WG Consensus: Waiting for Write-Up" state, which means the working group has agreed on it but it has not gone to the IESG and is not an RFC.
The problem is the internal call chain. A request hits an API gateway with a user's access token, then fans out across ten microservices, and by the third hop most architectures either forward the original broad token (a replay risk) or drop it and rely on network trust (no user context at all). A Transaction Token Service mints a Txn-Token at the edge, typically lasting minutes and bound to that one transaction, and downstream services verify it instead of the external token. A stolen Txn-Token is worth far less than a stolen access token, and every service can see who started the request and why. Expect it to show up alongside WIMSE and SPIFFE in service mesh and agent runtime designs.
See also: token exchange, WIMSE, workload identity, access token, token theft, workload identity 101, agent identity standards map 2026
Related on Start with Identity
- GlossaryWorkload Identity Federation
Workload identity federation lets a workload authenticate to a cloud provider by presenting a short-lived token from an identity provider it already has, such a
- GlossaryAuthorization Server
In OAuth 2.0, the component that authenticates the resource owner, obtains their authorization, and issues access tokens to clients. It exposes the authorizatio
- GlossaryIdentity Assertion JWT Authorization Grant (ID-JAG)
The Identity Assertion JWT Authorization Grant (ID-JAG) is a signed JWT, issued by an enterprise identity provider through OAuth 2.0 Token Exchange (RFC 8693),
- BlogA Check Point SmartConsole flaw hands out full admin tokens to unauthenticated attackers
CVE-2026-16232 (CVSS 9.3) lets an unauthenticated remote attacker obtain an application login token for Check Point Security Management and Multi-Domain Managem
- BlogA phantom join key let anyone mint JFrog Artifactory admin tokens, and exploitation started in days
CVE-2026-82329 (CVSS 9.8) is an authentication bypass in JFrog Access. Instances without an explicit join key got a predictable one, letting an unauthenticated
- BlogACR Stealer uses ClickFix lures to take browser tokens and OneDrive files
Microsoft reports ACR Stealer activity climbing in enterprise networks from late April to mid-June 2026. It arrives when someone pastes a command into the Windo