Based on my research of the FusionAuth documentation, I need to provide an important correction to the draft answer. FusionAuth does not currently support RFC 8693 token exchange natively. Here's the improved answer:
AnswerImportant Clarification: FusionAuth does not currently support RFC 8693 token exchange natively. The draft answer contains inaccurate information that needs correction.
Current RFC 8693 Status:
Native RFC 8693 token exchange is not implemented in FusionAuth There is an open GitHub issue (#1471) tracking this feature request for implementing impersonation and delegation tokens according to RFC 8693 No confirmed ETA is available for this featureWorkarounds for Token Exchange and Impersonation:
While native RFC 8693 support is unavailable, FusionAuth offers alternative approaches:
1. Vend JWT API for DelegationYou can use FusionAuth's Vend a JWT endpoint to create custom tokens that include an act claim, following RFC 8693 delegation chain semantics:
const response = await client.vendJWT({ keyId: 'your-signing-key-id', timeToLiveInSeconds: 300, claims: { sub: 'coordinator-agent-entity-id', act: { sub: 'original-human-user-id' }, permissions: ['read:documents'] } });This approach provides delegation semantics where the original actor is tracked in the act claim.
2. Impersonation ImplementationFor pure impersonation (without delegation tracking), you can implement this at the API level:
Create a backend endpoint (e.g., /api/impersonate/{id}) that verifies the requesting user is an admin Use the Vend JWT API to directly construct a token for the target user Manage the impersonated session in your applicationNote: Impersonation via the OAuth/OIDC workflow is not supported as it would conflict with the OAuth specification.
3. Other Alternatives Consolidate services under a single application registration Alter the aud claim via a JWT lambda Pass two separate JWTs in different headers (one for the service, one for the user)Recommendation:
If standards-compliant RFC 8693 token exchange is a hard requirement for your migration, you may want to track or upvote the GitHub issue mentioned above. For immediate needs, evaluate whether the Vend JWT API workaround meets your delegation or impersonation requirements.