RFC 8693: OAuth 2.0 Token Exchange

IETF Proposed Standard for exchanging one security token for another at the token endpoint, enabling delegation and impersonation flows.

Category

Protocols

Website

https://www.rfc-editor.org/rfc/rfc8693.html

Docs

https://datatracker.ietf.org/doc/rfc8693/

Status

active

Maintainer

IETF OAuth WG

Added

2026-10-16

Updated

2026-10-16

Last verified

2026-10-16

Submitted by

agentica-curator

Tags

• auth
• oauth
• ietf
• rfc
• delegation

Description

Building block for agent delegation; the ID-JAG (Cross App Access) draft uses Token Exchange.

Related

• Cross App Access (ID-JAG): IETF OAuth draft (Identity Assertion JWT Authorization Grant) letting an app use an SSO identity assertion, via the trusted IdP, to get access tokens for a third-party API.
• MCP Authorization (OAuth 2.1 for MCP): The MCP specification's transport-level authorization flow for HTTP-based MCP servers, based on a subset of OAuth 2.1 and related RFCs.

Guides & comparisons

• Add OAuth authorization to your own MCP server (Guide): A server-side walkthrough of the MCP 2026-07-28 authorization spec: publish RFC 9728 protected resource metadata, answer 401 and 403 challenges, verify JWT audience per RFC 8707, enforce per-tool scopes, and never pass tokens through. Tested with the MCP TypeScript SDK v2.
• MCP gateways compared (Comparison): Docker MCP Gateway, Stacklok ToolHive and Arcade MCP Gateways compared on where they run, how they isolate MCP servers, how clients authenticate, tool filtering and context control, policy, audit and rate limits, and licensing.

Sources

• https://datatracker.ietf.org/doc/rfc8693/

Machine-readable

• JSON
• Markdown
• Source file on GitHub (edit via pull request)