Glossary
OAuth token exchange
A grant that trades one access token for another, usually narrower one, for a specific downstream service.
- Standard
- RFC 8693
At OneLifeVibe
- The OneLifeVibe gateway never forwards an assistant's token to a website. For each tool call it exchanges it for a 5-minute token addressed to that one website (aud = the website, azp = olv-gateway) with only the scope the tool needs.
- Websites never see the assistant's token, and the gateway does not accept those website tokens back.
Related terms
See it working. The OneLifeVibe connector and Platform API put these pieces together.