Amazon Cognito now supports OAuth 2.0 token exchange

Amazon Cognito has introduced support for OAuth 2.0 token exchange, allowing services or AI agents to obtain new tokens scoped to specific downstream services on behalf of users. Previously, such services had to either forward the original token or maintain separate token generation logic. The new feature enables issuing tokens with narrower scopes, single audience binding, and no refresh tokens, simplifying delegation while maintaining security boundaries.

The token exchange process supports the inclusion of an actor token, which adds an 'act' claim identifying the intermediary service. This allows downstream services to distinguish between requests made directly by users and those made by agents acting on their behalf. For example, an MCP server can exchange a user's token for a narrowly scoped token to call a backend API, with the MCP server recorded as the actor in the claim.

Developers can perform token exchange through the token endpoint or the new GetDerivedToken API, providing flexibility in implementation. The feature is designed to streamline access delegation without requiring services to handle or forward original user tokens, reducing complexity in token management workflows.

Token exchange is available on the Essentials and Plus feature plans in all AWS Regions where Amazon Cognito operates. Documentation on exchanging tokens for downstream services is available in the Amazon Cognito Developer Guide for further guidance.