Tokens and credentials
Token exchange
Trading one token for another with different, usually narrower, privileges.
What Token exchange means
Token exchange lets a service swap a token it holds for a different one — typically narrower in scope, shorter in life, or addressed to a different audience. It is how a request keeps its identity as it crosses service boundaries without every service being handed the original, more powerful credential.
Defined in: RFC 8693.
How it works
The problem it solves is delegation. Service A receives a user's token and needs to call service B on their behalf. Passing the original token gives B everything A had, forever, and B may log it. Exchanging it for a token scoped to exactly the call B needs bounds the damage if B is compromised.
It also supports impersonation, where the new token acts as the user, and delegation proper, where it records that A is acting on behalf of the user. The distinction matters in an audit log: 'the user did this' and 'this service did this for the user' are different facts and should not be recorded as the same one.
Agent architectures make this newly urgent. An autonomous agent calling several services with one broad credential is a single compromise away from full privilege; exchanging down at each hop keeps the blast radius proportional to the action.
The mistake people actually make
Exchanging for a token with the same scopes as the original. It adds a round trip and no security, and it usually means nobody worked out what the downstream call actually needs.
In Authreads
How this applies here
Token Exchange is supported for machine and agent identity, alongside DPoP sender-constraining.
Every capability is listed on /roadmap as Available, In progress or Planned. Nothing is described as available here that is not listed as Available there.
Related terms
DPoP
Demonstrating Proof of Possession — binds a token to a key the client holds, so a stolen token alone is useless.
Machine identity
Credentials issued to a service, workload or agent rather than to a person.
Access token
A credential presented to an API to prove the caller is authorized, typically short-lived.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.