#Token Exchange
Delegation Done Right: Token Exchange and the On-Behalf-Of Pattern
Storing user credentials, forwarding tokens verbatim, or forcing constant re-authentication are the three ways teams get agent delegation wrong. Learn how OAuth 2.0 Token Exchange (RFC 8693) and JWT Bearer assertions (RFC 7523) solve it correctly.
Agent Identity: Why Your AI Agent Needs to Be a First-Class Principal
Giving an AI agent the user's token or a shared service-account credential collapses least privilege and attribution. Learn why an agent needs to be a distinct, first-class principal — and how RFC 8693's act claim already models it.
OAuth 2.0 Connect Token Exchange
OAuth 2.0 Token Exchange is an extension to the OAuth 2.0 protocol that allows a client to exchange one token for another. This can be useful in scenarios where a client needs to obtain a different type of token to access a resource or service. Learn how OAuth 2.0 Token Exchange works and when to use it.