ID-JAG is an emerging OAuth grant type that lets an existing identity assertion (such as an OIDC ID token) be exchanged for a new access token scoped to a different resource, carrying identity context forward across a chain of calls. It helps preserve a verifiable link back to the original human or agent identity as a request passes through multiple services.
Frequently asked questions
How is ID-JAG different from regular token exchange?
ID-JAG specifically starts from an identity assertion (like an ID token) rather than an access token, preserving a verifiable link to the original human or agent identity as the request moves through a chain of services.
Is ID-JAG a finalized, widely deployed standard?
It's an emerging grant type, worth tracking rather than assuming it's already broadly supported across authorization servers.
.avif)