Senior LevelREST APIs & Web Services
What is OAuth 2.0 Token Exchange (RFC 8693) and how is it used in microservice delegation?
❓ Interview Prompt: Explain OAuth 2.0 Token Exchange (RFC 8693), impersonation vs delegation, exchanging external user JWTs for scoped internal microservice tokens.
When an API Gateway receives an external user JWT, passing that full user token deep into internal backend microservices violates the Principle of Least Privilege:
OAuth 2.0 Token Exchange (RFC 8693):
An internal service exchanges an incoming subject token for a new, down-scoped target token specific to the downstream microservice:
•
'subject_token': External user JWT.
•
'actor_token': Calling microservice identity.
•
Returned token contains reduced permissions scoped ONLY for the target downstream service!
Code Implementation Example
http
POST /oauth/v2/token HTTP/1.1
Host: auth.example.com
Content-Type: application/x-www-form-urlencoded
grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange
&subject_token=eyJhbGciOi...
&subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Aaccess_token
&audience=billing-service-api💡OAuth 2.0 RFC 8693 Token Exchange request exchanging user token for down-scoped audience token.
🎯 Interview Key Takeaway
Use OAuth 2.0 Token Exchange (RFC 8693) to exchange user tokens for scoped internal microservice delegation tokens.
#Token Exchange#RFC 8693#OAuth 2.0#Senior
Back to all REST APIs & Web Services Questions→