Compose & understand OAuth Token Exchange

Build the exact RFC 8693 token-exchange request body and see what it asks the STS to do — delegation vs impersonation, scoping, and down-scoping — 100% in your browser. No network, no server, nothing stored. Pasted subject/actor tokens are decoded locally and never uploaded.

subject_token

subject_token_type

requested_token_type (optional)

actor_token (optional — present ⇒ delegation)

actor_token_type (required if actor_token set)

scope (optional, space-delimited)

resource (optional URI)

audience (optional)

Everything runs in this tab. Tokens are decoded locally with base64url + JSON and are never uploaded.

Compose & understand OAuth Token Exchange

tokenexchange