# Amazon Cognito adds scoped token exchange for services and AI agents

_Published Thursday, November 12, 2026 at 7:18 PM EST · AI, Infrastructure · Latest · Tier 2 — Notable_

AWS has added OAuth 2.0 token exchange to Amazon Cognito, allowing services and AI agents acting for a user to obtain credentials limited to a downstream service. Previously, intermediaries had to forward the user's original token or maintain their own token creation logic.

The replacement token can carry narrower permissions, target a single service and omit a refresh token. An optional actor token records the intermediary's identity so downstream services can distinguish delegated requests from direct user requests. The feature is available on Cognito's Essentials and Plus plans in every AWS Region where Cognito operates.

## Sources

- [Recent Announcements](https://aws.amazon.com/about-aws/whats-new/2026/11/cognito-token-exchange/)

---
Canonical: https://techandbusiness.org/newswire/5ffaXpgFu347n5y0iZV-iC
Published: 2026-11-13T00:18:11.725Z
Story chronology: 2026-11-12T22:00:00.000Z
Retrieved: 2026-11-13T03:04:02.448Z
Publisher: Tech & Business (techandbusiness.org)