2026-09-08 · 8 min read
- jwt
- oauth
- authorization
Delegation allows one principal, often a service, to act for another principal, often a user or workload. The resulting token may need to preserve both identities so authorization and auditing do not collapse the resource owner and immediate caller into one ambiguous subject.
OAuth token exchange and issuer-specific profiles define how a trusted authorization service evaluates an input credential and issues a new token. An application should not manufacture delegation by copying claims between decoded JWTs.
Define the actors and requested authority
For each exchange, identify the requesting client, input-token issuer and subject, immediate actor, requested resource or audience, requested scopes, resulting token type, and authorization policy that permits the relationship.
- Authenticate the client performing the exchange.
- Validate the input token under its own profile.
- Constrain requested audiences and scopes server-side.
- Reject unsupported delegation depth or token types.
Validate the issued token independently
The receiving API validates the exchanged token's signature, issuer, audience, lifetime, and profile as a new credential. It should not rely on a gateway merely having decoded the original token.
Treat nested actor data as issuer-authenticated claims only after verification. Then apply policy to the subject, actor, tenant, scopes, resource, and operation together.
Bound lifetime, chaining, and revocation
Delegated credentials should be narrowly scoped and short-lived. Define whether another exchange is allowed, how many links may exist, and which original grant or session can revoke the chain.
- Prevent scope and audience expansion across exchanges.
- Use stable identifiers rather than mutable display names.
- Record both subject and actor in protected audit events.
- Avoid placing bearer tokens in logs, URLs, or analytics.
Test policy combinations
Use Flashman's JWT tool for synthetic claim inspection, JSON formatter for nested types, diff for before-and-after token fixtures, timestamp converter for lifetime boundaries, and URL tool for exact issuer and audience identifiers.
Test absent and malformed actor claims, wrong tenants, disallowed audiences, scope reduction, attempted scope expansion, expired grants, revoked subjects, key rotation, nested exchanges, direct API access, and audit attribution.