Token exchange is an OAuth 2.0 extension that lets one token be exchanged for another, often to convert a broader credential into a narrower, resource-specific one, or to pass identity context from one service to another in a chain of calls. It's a common building block in agentic architectures, where a request may pass through several services before reaching the resource an agent is ultimately trying to use.
Frequently asked questions
Why would an agent need to exchange a token instead of just using the one it has?
A request often passes through multiple services before reaching its final destination, and token exchange lets each hop narrow the credential to only what that specific step needs.
Is token exchange the same as a refresh token flow?
No, a refresh token gets a new access token for the same client and scope; token exchange converts a token into a different one, often with a different audience or narrower scope.
.avif)