Token exchange and delegation
When a user asks an application, which calls a service, which calls another, each hop should hold a token that is good for exactly that hop and records who asked. LumoAuth implements token exchange, actor chains, cross-app access and a vault for third-party tokens.
Passing the user's token around is the confused-deputy problem waiting to happen
Services forward the original token to each other, every service can do everything the user can, and nobody can tell from a token which path it took.
How LumoAuth solves it
Token exchange
Trade a token for one with a narrower audience and scope, and an actor claim that records the service doing the trading. Docs
Delegation chains for agents
User to agent to sub-agent to tool, each hop recorded in the act claim. Docs
Cross-app access
An enterprise identity provider's assertion lets one application call another on the user's behalf without a second sign-in. Docs
Token vault
Hold the Google, GitHub or Salesforce tokens an agent needs for a user. The agent gets a reference; the vault refreshes the real token. Docs
Refresh token rotation
Every refresh issues a new token; reuse of an old one revokes the family. Docs
Introspection and revocation
Standard endpoints for APIs that need to ask, and for clients that need to invalidate. Docs
Setting it up
Allow exchange for the client
Enable the token-exchange grant and the audiences it may request.
Exchange at each hop
One call to the token endpoint with the incoming token as the subject.
Read the chain
The act claim lists every party; audit entries carry it too.
Standards involved
Plain names on the left, the specification on the right. The full map is in the standards reference.
- Token exchange
- RFC 8693
- Actor claims
- OAuth actor profile draft
- Cross-app access
- Identity assertion authorization grant draft
- Transaction tokens
- IETF draft
- Introspection and revocation
- RFC 7662, RFC 7009
Which plan you need
Token exchange, introspection and revocation are on every plan. Delegation chains and the token vault are in the Agent Governance add-on on Pro and included in Business.
Documentation
Questions
Can I see the chain in logs?
Ship passwordless sign-in this week. Put guardrails on your agents today.
The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.