OAuth 2.0 Token Exchange (RFC 8693)

1. Token exchange request

   subject_token, actor_token, requested_token_type, audience and resource.

2. Token exchange response

   issued_token_type and returned token.

3. Delegation vs impersonation

   Semantics of acting on behalf of vs impersonating.

4. act claim

   Actor claim describing delegation chains.

5. may_act claim

   Authorizing which actors can act for a subject.

6. Security considerations

   Token scope reduction and trust boundaries.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.