At the AS token endpoint, accept grant_type urn:ietf:params:oauth:grant-type:token-exchange with parameters: subject_token, subject_token_type (e.g. urn:ietf:params:oauth:token-type:access_token or id_token), requested_token_type, audience, scope, and optionally actor_token
Validate the subject_token: verify its signature against the issuer's JWKS, check expiry, confirm the subject is allowed to delegate to the requesting client for the requested audience and scopes
For delegation (acting on behalf of a user), issue the new token with an act claim containing {sub: <client_id>} to record the acting party; for impersonation, issue without the act claim
Set the issued_token_type in the response to match the requested_token_type; return the token with appropriate expires_in and scope reflecting what was actually granted (may be narrower than requested)
Enforce authorization policy: the exchanging client must be explicitly authorized to perform token exchange for the subject and the target audience — do not allow any authenticated client to exchange any token
Log the exchange event with subject, actor, target audience, and issued scopes for audit; token exchange chains are a common lateral movement vector if not properly constrained
Known gotchas
RFC 8693 Token Exchange and OIDC back-channel logout share no mechanism — do not confuse token exchange (delegating access) with token introspection (validating a token's state)
Chained token exchange (A exchanges to get B, B exchanges to get C) can create unbounded delegation chains; implement a maximum delegation depth and record the full may_act chain in the act.act claim to make it auditable
The audience parameter in the exchange request scopes the new token to a specific resource server; if audience is omitted, the issued token may be usable against unintended services — require audience explicitly in sensitive deployments
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp