What is token exchange?
In short:Token exchange, defined in RFC 8693, lets a service trade one token for another with a different audience, scope or actor. It is the standard building block for on-behalf-of flows, where an agent needs a narrow token that still names the person it serves.
How does it work?
The client posts a subject token and optional actor token to the token endpoint and receives a new, narrower token.
What does it look like in practice?
An agent swaps a user's sign-in token for a token valid only for the calendar API.