What is token exchange?
Token exchange is the practice of presenting a token issued by one trusted party in order to obtain a different, usually more narrowly scoped, token from another.
It solves a specific problem in embedded software: your application already knows who the user is, but the platform you are calling has no reason to trust your word for it. Rather than sharing a long-lived secret, your backend signs a short-lived assertion, and the platform — which knows your signing key — issues a token scoped to that user.
Because the exchange happens server to server, the browser never holds anything durable. The resulting token is short-lived and carries only the permissions the exchange granted.
The host backend signs an RS256 assertion naming the tenant and subject. The control plane validates it against a registered issuer, resolves or creates the end user, and returns a gateway token valid for five minutes.
Related terms
- JWKS — A JSON document publishing the public keys a party uses to sign tokens, so verifiers can validate signatures without shared secrets.
- Trusted issuer — A registered identity provider whose signed assertions a platform is willing to accept.
- Service account — A non-human identity used by software to authenticate, carrying only the permissions it was granted.
See it working rather than described.
The product demo runs one agent across three systems and stops at the approval gate.