WSO2 Changelog
Feature
Asgardeo
- 15 Sep, 2026
Delegation support and other improvements on token exchange grant
Introduces delegation support in the token exchange grant as defined in RFC 8693 (OAuth 2.0 Token Exchange), with 2 other improvements to the flow.
- Delegation lets an application exchange a token while preserving the identity of the party acting on behalf of the user. The application sends an actor token alongside the subject token, and the issued token records the acting party in the act claim. Re-exchanging a delegated token nests the existing act claim, so a single token carries the full delegation chain.
- A new audience parameter is supported, which narrows the audience of the issued token to a single value registered on the application, instead of its full audience list.
- Subject tokens issued by WSO2 Identity Platform are now trusted for token exchange, so the token endpoint no longer needs to be registered as an audience on the subject token application.
Documentation: