OAuth 2.0 Token Exchange

Implements RFC 8693 (OAuth 2.0 Token Exchange) with extensions.

Validates a partner access token and exchanges it for a JWT token. This implementation uses the requested_subject field (common extension to RFC 8693) to specify the platform user ID for whom the token is being requested.

Security considerations:

• Uses HTTPS in production (enforced by infrastructure)
• Validates partner access token
• Generates cryptographically secure JWT tokens

Grant Type:

• Only urn:ietf:params:oauth:grant-type:token-exchange grant type is supported

Authentication:

• This endpoint does NOT require a bearer token
• Authentication is performed using the subject_token in the request body

{
  "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
  "subject_token": "partner_access_token_abc123",
  "subject_token_type": "urn:ietf:params:oauth:token-type:access_token",
  "requested_subject": "user_id_xyz789",
  "scope": "ADMIN"
}

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.refresh...",
  "customer_user_id": "759a086f-48b3-4e34-aefd-00c8a9e68523"
}