Protocol practice· Federation & Identity Standards Members
Token exchange: one API calls another, on the user’s behalf
Objective: When Maya upgrades in Lumen Notes, the notes API has to ask the billing API for her invoice. Get a token billing will accept, that still says it’s Maya, says the notes API is the one asking, and can do no more than read her invoice.
5 steps12 concepts 12 min
Where token exchange fitsNot sure? Which protocol?
What may this app do? · 6 labs
- OAuth
- Token exchangeYou are here
- Workload federation
- JWT validation
- Just-in-time admin
- Conditional Access
What you’ll do
- 1Decide what to send to billing. Maya’s browser called the notes API with her access token.
- 2Send the exchange request. The notes API is a confidential client: it authenticates to the authorization server with its own key.
- 3Make it delegation, and keep it small. Billing’s logs should show that the notes API asked, on Maya’s behalf, not that Maya asked herself.
- 4Billing decides what to allow. Billing receives the new token.
- 5Billing calls the tax service. To total the invoice, billing calls the tax service, and exchanges again, with itself as the actor.