[{"data":1,"prerenderedAt":170},["ShallowReactive",2],{"term-t\u002Ftoken-exchange":3,"related-t\u002Ftoken-exchange":150},{"id":4,"title":5,"acronym":6,"body":7,"category":130,"description":131,"difficulty":132,"extension":133,"letter":134,"meta":135,"navigation":136,"path":137,"related":138,"seo":144,"sitemap":145,"stem":148,"subcategory":6,"__hash__":149},"terms\u002Fterms\u002Ft\u002Ftoken-exchange.md","Token Exchange",null,{"type":8,"value":9,"toc":124},"minimark",[10,15,19,23,26,30,113,117,120],[11,12,14],"h2",{"id":13},"eli5-the-vibe-check","ELI5 - The Vibe Check",[16,17,18],"p",{},"Token exchange is when one service walks up with a token that proves who it is, and trades it in for a different, narrower token that only works for the one specific thing it's about to do next. Like handing over your ID at a hotel front desk and getting back a room key that only opens door 214, not a master key to the whole building.",[11,20,22],{"id":21},"real-talk","Real Talk",[16,24,25],{},"Token exchange, defined in RFC 8693, is an OAuth 2.0 extension that lets a client present one security token and receive a different token in return, often with reduced scope, a different audience, or a different subject. It's commonly used to propagate identity across service boundaries without passing the original credential downstream, or to downscope a broad token before calling a less-trusted service.",[11,27,29],{"id":28},"show-me-the-code","Show Me The Code",[31,32,37],"pre",{"className":33,"code":34,"language":35,"meta":36,"style":36},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -X POST https:\u002F\u002Fauth.example.com\u002Foauth2\u002Ftoken \\\n  -d grant_type=urn:ietf:params:oauth:grant-type:token-exchange \\\n  -d subject_token=$INBOUND_TOKEN \\\n  -d subject_token_type=urn:ietf:params:oauth:token-type:access_token \\\n  -d audience=downstream-service \\\n  -d scope=read:orders\n","bash","",[38,39,40,63,74,85,95,105],"code",{"__ignoreMap":36},[41,42,45,49,53,56,59],"span",{"class":43,"line":44},"line",1,[41,46,48],{"class":47},"sBMFI","curl",[41,50,52],{"class":51},"sfazB"," -X",[41,54,55],{"class":51}," POST",[41,57,58],{"class":51}," https:\u002F\u002Fauth.example.com\u002Foauth2\u002Ftoken",[41,60,62],{"class":61},"sTEyZ"," \\\n",[41,64,66,69,72],{"class":43,"line":65},2,[41,67,68],{"class":51},"  -d",[41,70,71],{"class":51}," grant_type=urn:ietf:params:oauth:grant-type:token-exchange",[41,73,62],{"class":61},[41,75,77,79,82],{"class":43,"line":76},3,[41,78,68],{"class":51},[41,80,81],{"class":51}," subject_token=",[41,83,84],{"class":61},"$INBOUND_TOKEN \\\n",[41,86,88,90,93],{"class":43,"line":87},4,[41,89,68],{"class":51},[41,91,92],{"class":51}," subject_token_type=urn:ietf:params:oauth:token-type:access_token",[41,94,62],{"class":61},[41,96,98,100,103],{"class":43,"line":97},5,[41,99,68],{"class":51},[41,101,102],{"class":51}," audience=downstream-service",[41,104,62],{"class":61},[41,106,108,110],{"class":43,"line":107},6,[41,109,68],{"class":51},[41,111,112],{"class":51}," scope=read:orders\n",[11,114,116],{"id":115},"when-youll-hear-this","When You'll Hear This",[16,118,119],{},"\"The gateway does a token exchange before forwarding the request to the third-party integration.\" \u002F \"Use token exchange to swap the user's broad token for a service-scoped one before calling the downstream API.\"",[121,122,123],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":36,"searchDepth":65,"depth":65,"links":125},[126,127,128,129],{"id":13,"depth":65,"text":14},{"id":21,"depth":65,"text":22},{"id":28,"depth":65,"text":29},{"id":115,"depth":65,"text":116},"security","Token exchange is when one service walks up with a token that proves who it is, and trades it in for a different, narrower token that only works for the on...","advanced","md","t",{},true,"\u002Fterms\u002Ft\u002Ftoken-exchange",[139,140,141,142,143],"OAuth2","OAuth Scopes","JWT","Access Token","PKCE",{"title":5,"description":131},{"changefreq":146,"priority":147},"weekly",0.7,"terms\u002Ft\u002Ftoken-exchange","0QbkZLNCvL_9S7V-lh4yuGqFVYKXm9zthfhbiciA1P8",[151,155,161,164,167],{"title":142,"path":152,"acronym":6,"category":130,"difficulty":153,"description":154},"\u002Fterms\u002Fa\u002Faccess-token","beginner","An Access Token is your short-lived pass to access an API. It proves you're authenticated and what you're allowed to do.",{"title":141,"path":156,"acronym":157,"category":158,"difficulty":159,"description":160},"\u002Fterms\u002Fj\u002Fjwt","JSON Web Token","backend","intermediate","A JWT is a special kind of token that contains information inside it. It has three parts: a header, a payload (with your user ID, role, etc.",{"title":140,"path":162,"acronym":6,"category":130,"difficulty":159,"description":163},"\u002Fterms\u002Fo\u002Foauth-scopes","OAuth Scopes define what an app is allowed to do with your account. 'Read your email' is a scope. 'Send email on your behalf' is another.",{"title":139,"path":165,"acronym":6,"category":158,"difficulty":159,"description":166},"\u002Fterms\u002Fo\u002Foauth2","OAuth2 is the updated version of OAuth that everyone actually uses today.",{"title":143,"path":168,"acronym":6,"category":130,"difficulty":132,"description":169},"\u002Fterms\u002Fp\u002Fpkce","PKCE (pronounced 'pixy') prevents someone from stealing your OAuth authorization code and using it.",1792528131653]