OAuth token exchange (RFC 8693)
In short:OAuth token exchange, RFC 8693, lets a service trade one token for another with a different audience or scope. It can carry both the person and the acting party. That makes it a common building block for on-behalf-of delegation by agents.
What is it?
A client posts a subject token, and optionally an actor token, to the token endpoint. It gets back a new token for a named audience.
The act claim records who is acting for whom.
Why do agents need it?
An agent acting for a person should not reuse that person's broad token. Exchange narrows the token to one API and one task.
The act claim keeps the delegation chain visible to downstream services.
Which scored platforms name it?
Not found in public material for any of the ten scored platforms.
Other scored platforms: not found in public material read on 3 November 2026.
Other standards
- OAuth 2.1
- MCP authorization
- Enterprise-Managed Authorization (Cross App Access, ID-JAG)
- Client ID Metadata Documents (CIMD)
- SPIFFE
- DPoP and mTLS
- CIBA (human approval)
Sources
- [mcp-ema] MCP Enterprise-Managed Authorization. https://blog.modelcontextprotocol.io/posts/enterprise-managed-auth/. Read .