Auth0 Token Exchange — Token Exchange and Impersonation with Auth0

// Token exchange for downstream service
async function exchangeToken(currentToken, targetAudience) {
  const response = await axios.post(`https://{tenant}.auth0.com/oauth/token`, {
    grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
    subject_token: currentToken,
    subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',
    audience: targetAudience,
    scope: 'scan:write report:read',
    requested_token_type: 'urn:ietf:params:oauth:token-type:access_token'
  }, {
    headers: {
      'Auth0-Client': JSON.stringify({ name: 'scan-app', version: '1.0' })
    }
  });

  return response.data.access_token;
}

// Usage in API gateway
app.use('/api/reports', async (req, res, next) => {
  try {
    const reportToken = await exchangeToken(
      req.headers.authorization.split(' ')[1],
      'https://report-service.example.com'
    );
    req.downstreamToken = reportToken;
    next();
  } catch (err) {
    res.status(401).json({ error: 'Token exchange failed' });
  }
});