Token Exchange

ELI5 - The Vibe Check

Token exchange is when one service walks up with a token that proves who it is, and trades it in for a different, narrower token that only works for the one specific thing it's about to do next. Like handing over your ID at a hotel front desk and getting back a room key that only opens door 214, not a master key to the whole building.

Real Talk

Token exchange, defined in RFC 8693, is an OAuth 2.0 extension that lets a client present one security token and receive a different token in return, often with reduced scope, a different audience, or a different subject. It's commonly used to propagate identity across service boundaries without passing the original credential downstream, or to downscope a broad token before calling a less-trusted service.

Show Me The Code

curl -X POST https://auth.example.com/oauth2/token \
  -d grant_type=urn:ietf:params:oauth:grant-type:token-exchange \
  -d subject_token=$INBOUND_TOKEN \
  -d subject_token_type=urn:ietf:params:oauth:token-type:access_token \
  -d audience=downstream-service \
  -d scope=read:orders

When You'll Hear This

"The gateway does a token exchange before forwarding the request to the third-party integration." / "Use token exchange to swap the user's broad token for a service-scoped one before calling the downstream API."