OAuth 2.0 Token Exchange (RFC 8693) enables converting one security token into another for different contexts, audiences, or purposes. The post covers four main use cases: administrative impersonation (support engineers seeing what users see), protocol transition (bridging SAML and OIDC during migrations), service chain delegation (microservices calling each other while preserving user identity via the `act` claim), and federated identity across security domains. The delegation model is highlighted as the principled choice for microservice chains, as it preserves both user and service identity for auditability. Cross App Access (XAA) and Identity Chaining are introduced as solutions to the scaling problem of bilateral trust in multi-domain scenarios. Auth0-specific implementations covered include Custom Token Exchange, Token Vault for AI agents, On-Behalf-Of token exchange, and Cross App Access.
