Amazon Cognito adds OAuth 2.0 token exchange for AI agents and MCP servers

Amazon Web Services launched OAuth 2.0 token exchange in Amazon Cognito on November 12, 2026, implementing RFC 8693 so that a service or AI agent can swap a user's token for a narrower token scoped to a specific downstream API, according to Amazon Web Services' announcement.

What AWS changed

• Amazon Cognito now supports OAuth 2.0 token exchange per RFC 8693, announced on November 12, 2026.
• A service or AI agent can exchange a user's token for a token scoped to a specific downstream API.
• Exchanged tokens are single-audience and do not include a refresh token.
• Exchanged tokens carry an act claim that identifies the intermediary that performed the exchange.
• AWS names MCP servers as an example actor that can use this token exchange flow.
• The feature works through the standard OAuth token endpoint or a new GetDerivedToken API, on Cognito Essentials and Plus plans across all Cognito regions.

Why it matters for AI agent builders

The update gives developers building AI agents and Model Context Protocol integrations a standard way to scope down the credentials passed to tools, addressing a common security gap where AI agents hold overly broad token access. By exchanging a broad token for one that is single-audience, tied to a specific downstream API, and tagged with an act claim showing which intermediary performed the exchange, teams can limit what an agent or MCP server can do with a credential and audit who requested it.

Availability

The token exchange flow is available through Amazon Cognito's standard OAuth token endpoint or through the new GetDerivedToken API, on Cognito's Essentials and Plus plans across all Cognito regions.

Sources

• Amazon Cognito launches OAuth 2.0 token exchange (Amazon Web Services, November 12, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.