Amazon Cognito now supports OAuth 2.0 token exchange as defined in RFC 8693. The new feature lets a service or AI agent exchange a user’s token for a fresh token that has a tighter scope and no refresh token. The exchanged token includes an act claim that identifies the intermediary, so downstream services can see that a request came via an agent. Token exchange can be done via the standard token endpoint or the new GetDerivedToken API, and is available on the Essentials and Plus plans in every AWS region where Cognito runs.
Why it matters
Developers can give backend services limited‑purpose tokens, reducing the risk of over‑privileged access when agents act for users.
