# Amazon Cognito adds OAuth 2.0 token exchange

> Cognito can now swap a user’s token for a narrower, single‑audience token, helping services act on a user’s behalf without forwarding the original token.

Oossa · 2026-11-13 · https://oossa.com/en/amazon-cognito-adds-oauth-2-0-token-exchange

Amazon Cognito now supports OAuth 2.0 token exchange as defined in RFC 8693. The new feature lets a service or AI agent exchange a user’s token for a fresh token that has a tighter scope and no refresh token. The exchanged token includes an act claim that identifies the intermediary, so downstream services can see that a request came via an agent. Token exchange can be done via the standard token endpoint or the new GetDerivedToken API, and is available on the Essentials and Plus plans in every AWS region where Cognito runs.

## The facts

- Feature announced on 2026-11-12 ("Thu Nov 12 2026").
- Available on Cognito Essentials and Plus plans across all AWS regions.

## Why it matters

Developers can give backend services limited‑purpose tokens, reducing the risk of over‑privileged access when agents act for users.

## Sources & references

1. [Amazon Cognito now supports OAuth 2.0 token exchange](https://aws.amazon.com/about-aws/whats-new/2026/11/cognito-token-exchange/) – AWS, 2026-11-12

Last updated: 2026-11-13