Cybersecurity glossary
What is Token Exchange?
Learn what OAuth token exchange is, how services trade tokens for new audiences or actors, common use cases like on-behalf-of flows, and security controls that prevent privilege escalation.
Definition
Token exchange is an OAuth 2.0 extension (RFC 8693) that lets a client present an existing security token to an authorization server and receive a new token—often with a different audience, scope set, or actor identity—for controlled delegation between APIs and services.
Why token exchange matters
Microservices rarely call each other with the original browser token unchanged. Audiences differ, scopes must shrink, and intermediate services need a recorded actor identity. Token exchange gives authorization servers a standard way to mint those derived credentials.
Done well, it enables least-privilege delegation. Done poorly, it becomes a privilege-escalation vending machine.
Common exchange use cases
Re-audience for downstream APIs
Convert a gateway-facing token into one accepted by an internal resource server.
On-behalf-of calls
Preserve the user subject while adding the calling service as actor.
Downscoping
Trade a broad token for a narrower scope set before sensitive operations.
Legacy token translation
Exchange proprietary tokens into standard JWT access tokens under policy.
How an OAuth token exchange works
Client authenticates to the AS
A confidential client proves its identity to the authorization server.
Present the subject token
The existing token (and optional actor token) is submitted to the exchange endpoint.
Server evaluates policy
Issuer trust, audiences, scopes, and delegation rules are enforced.
New token is minted
A token with approved audience, scopes, subject, and actor claims is returned.
Downstream API is called
The exchanged token is presented only to its intended resource server.
Audit trail links the chain
Subject, actor, and exchange IDs support investigation of delegated access.
Security properties to enforce
| Control | Purpose |
|---|---|
| No silent upscoping | Prevent exchange from granting broader scopes than policy allows |
| Audience rewriting rules | Allow only approved target APIs |
| Actor attribution | Record which service acted on behalf of the user |
| Client authentication | Stop arbitrary parties from exchanging stolen tokens |
| Short-lived outputs | Limit replay of derived tokens |
| Token type restrictions | Accept only expected subject_token types |
Token exchange hardening checklist
- Implement RFC 8693 with explicit policy—not ad-hoc token minting in app code.
- Authenticate exchanging clients; do not allow public clients to mint arbitrary delegated tokens.
- Deny scope escalation; prefer downscoping by default.
- Validate inbound subject tokens fully before exchange.
- Set precise aud on exchanged tokens and enforce it downstream.
- Include actor claims for on-behalf-of flows and log them.
- Rate-limit and monitor exchange endpoints for abuse.
- Threat-model impersonation features separately—they are high risk by design.
The practical takeaway
Token exchange is standardized delegation: trade one token for another under authorization-server policy. It keeps microservice identities auditable and least-privileged when constrained tightly.
If exchange can mint broader powers than the input token, fix the policy before scaling the pattern.
Related security terms
Access Token
The usual input and output credential type in exchange flows.
OAuth 2.0
Base authorization framework extended by token exchange.
Audience Claim (aud)
Often changes during exchange when targeting a new resource server.
JWT (JSON Web Token)
Common format for subject and actor tokens in exchange requests.
Privilege Escalation
Risk when exchange policies mint broader tokens than intended.
Frequently asked questions
What is token exchange in simple terms?
It is a controlled trade-in: a service shows a token it already has and receives a different token that is better suited for the next API call—like changing a visitor badge for a lab-specific badge.
Is token exchange the same as refresh tokens?
No. Refresh tokens renew access for the same client grant. Token exchange deliberately transforms identity, audience, or delegation context under authorization-server policy.
What is an on-behalf-of flow?
A pattern where a middleware service calls downstream APIs using a token that preserves the original user subject while adding the service as an actor.
What standards define this?
OAuth 2.0 Token Exchange is defined in RFC 8693, with JWT actor claims and related profiles used in many implementations.
Can token exchange increase privileges?
It must not without explicit policy. Secure authorization servers only downscope or re-audience according to strict rules.
Who should call the token exchange endpoint?
Typically confidential services, API gateways, or backends—not browsers directly—under mutually authenticated client credentials.
How do you audit exchanged tokens?
Preserve subject and actor identifiers in logs, and correlate exchange transactions with downstream API access.
References
Explore authoritative guidance and frameworks related to token exchange.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.