OAuth Token Exchange

RFC 8693 token exchange delegation grant.

Definition

Token Exchange parameters: grant_type=urn:ietf:params:oauth:grant-type:token-exchange, subject_token (initial token), subject_token_type, requested_token_type, actor_token (acting on behalf), audience (target). Use cases: federation (IdP token -> internal token), delegation (admin acting for user), impersonation (support agent), microservices context propagation.

Origin

IETF OAuth WG, RFC 8693 published January 2020.

Usage

Widely adopted microservices auth (Istio, Linkerd, SPIFFE/SPIRE), multi-tenant platforms (Slack, GitHub Apps, Zoom Apps), Kubernetes workload identity.

Related terms

• OAuth 2.0 — standard parent.
• SPIFFE / SPIRE — workload identity ecosystem.
• K8s SA tokens — cas usage.