Token Exchange
also called RFC 8693, Delegation Token
Trading one token for another with different scope, audience or subject, so a service can call downstream on a user's behalf without reusing the original token.
The problem it solves appears in every service architecture with a user at the front. Service A receives the user's access token. It needs to call B, which needs to call C. Passing the original token onward means every service in the chain holds a credential valid for the whole audience — so a compromise anywhere is a compromise everywhere, and C cannot tell whether it was called by A legitimately or by a compromised B replaying a token it should not have.
Token exchange has A present the user's token to the authorisation server and receive a new token scoped to B specifically, carrying both the user's identity and the fact that A is acting for them. B repeats the process for C.
What this buys: audience restriction so a stolen token is useful only against one service, a delegation chain visible in the token for audit, downscoped permissions at each hop, and independently short lifetimes.
The cost is a call to the authorisation server per hop, which pushes teams towards caching exchanged tokens for their lifetime — reasonable, provided the cache is keyed by user and audience and never outlives revocation tolerance.