Token Exchange
Token Exchange defines how a client can present one token and receive a different token — either of the same type with different scopes, or a different token type entirely — enabling delegation chains and cross-service authorization.
When to use this
Use Token Exchange for service-to-service delegation in microservice architectures (a backend service acting on behalf of the original user when calling downstream services), for native app SSO (sharing tokens between multiple apps without re-prompting the user), or when a resource server needs to obtain its own tokens to call another service.
The client POSTs to the token endpoint with grant_type=urn:ietf:params:oauth:grant-type:token-exchange, providing the subject token and specifying what kind of token it wants back. The authorization server may issue a token that impersonates the subject or delegates on their behalf, depending on policy.
Use cases
- Service-to-service delegation: microservice A calls microservice B on behalf of a user
- Native SSO: multiple mobile apps on the same device share an access token without re-prompting
- Token format conversion: exchange an opaque token for a JWT, or a JWT for a different audience
More resources
- Native SSO: Desktop and Mobile Apps Single-Sign-On (developer.okta.com)
- How to Create a Seamless Mobile SSO Experience in iOS (developer.okta.com)