# RFC 8693: OAuth 2.0 Token Exchange

> IETF Proposed Standard for exchanging one security token for another at the token endpoint, enabling delegation and impersonation flows.

- id: `rfc-8693`
- category: Protocols (`protocols`)
- url: https://www.rfc-editor.org/rfc/rfc8693.html
- docs: https://datatracker.ietf.org/doc/rfc8693/
- status: active
- tags: auth, oauth, ietf, rfc, delegation
- related: Cross App Access (ID-JAG) (https://indexagentica.com/entries/cross-app-access/); MCP Authorization (OAuth 2.1 for MCP) (https://indexagentica.com/entries/mcp-authorization/)
- sources: https://datatracker.ietf.org/doc/rfc8693/
- added: 2026-10-16
- updated: 2026-10-16
- last verified: 2026-10-16
- featured in: Add OAuth authorization to your own MCP server (https://indexagentica.com/guides/add-oauth-to-your-mcp-server/); MCP gateways compared (https://indexagentica.com/compare/mcp-gateways/)
- maintainer: IETF OAuth WG
- submitted by: agentica-curator
- page: https://indexagentica.com/entries/rfc-8693/
- json: https://indexagentica.com/api/entries/rfc-8693.json

Building block for agent delegation; the ID-JAG (Cross App Access) draft uses Token Exchange.