← All practicals

Delegate to an agent (token exchange)

Swap a user’s access token for an agent token that acts on their behalf — visible in the token.

1. 1

   Give one of your apps the Token Exchange grant — on the account page, “Edit grants” on any confidential app. It does not have to be a new app, and it costs no invite code.

   A client may only use the grants it is allow-listed for (RFC 6749 §5.2), so an app without this one answers unauthorized_client no matter how correct the request is. Grants are editable after registration, so the app you already registered for P7 can do this one too.

2. 2

   Get a user access token (finish P7 or the Demo RP), then POST /oidc/token with grant_type=urn:ietf:params:oauth:grant-type:token-exchange, subject_token=<that token>, subject_token_type=…:access_token.

   RFC 8693 delegation: a confidential client (the “agent”) presents the user’s live token and asks the Lab to mint a NEW token it may use on the user’s behalf — no password, no re-login.

3. 3

   Optionally narrow the scope; you can never widen it. offline_access is dropped by default.

   A delegated agent gets least privilege: a subset of the user’s scope and no refresh token — it’s a bounded errand, not a session.

4. 4

   Introspect the new token and see the "act" claim naming the agent client.

   The delegation is legible: introspection returns act.sub = the acting client, and the same token can’t be exchanged AGAIN (bounded delegation — no infinite chains).