Token Exchange for MCP Server Tools

Security Recommendation

When an MCP server needs to access third-party APIs on behalf of a user, the preferred approach is to use SPIFFE/SPIRE+mTLS. When that is not feasible, the MCP server SHOULD perform an OAuth 2.0 Token Exchange (RFC 8693) to swap the user's original token for a scoped, short-lived token.

Why Token Exchange

Token Exchange provides:

• User identity preserved (sub claim carries the original user's identity as the subject)
• MCP server identity included (act claim identifies the MCP server as the actor)
• Scoped access (exchanged token is limited to the permissions needed for the specific tool)
• Short-lived (exchanged token has a reduced TTL)
• No token passthrough (original user token is never sent to downstream services)
• Audit trail (both user and server identity are captured in the exchanged token)

Token Exchange Flow