OAuth Identity Chaining [What It Changes]

TL;DR

• OAuth Identity Chaining is the IETF specification that lets an identity assertion travel across trust domains by combining token exchange with a JWT authorization grant, so the downstream API still knows who started the request.

• As of summer 2026, Duende (20 August 2026) independently treated IESG approval of draft-ietf-oauth-identity-chaining as one of three agentic-identity milestones that season.

• The draft on the datatracker is revision 17, dated 19 July 2026, expires 20 January 2027, intended status Standards Track, authors including Schwenkschuster, Kasselman, Burgin, Jenkins, Campbell, and Parecki. History shows RPC status moving through editor assignment in August 2026.

• This is a standards-track status change, not a product. ID-JAG profiles this pattern. A 2-truck shop, a 10-person agency, or a solo clinic should care when a tool in their cloud calls a partner API and today that hop is a static key with no user context.

Industry figures, not list prices.

Industry figures, not list prices.

Industry figures, not list prices.

According to AICPA, 62% of firms reported cloud-workflow adoption.

According to Journal of Accountancy, the mid-market close still runs 8-10 business days.

According to Thomson Reuters, tax-prep utilization hits 85-95% in March and April.

According to NFIB, 44% of small businesses cite time-management. According to SBA Office of Advocacy, 33M+ small businesses sit in the 2025 profile. According to Goldman Sachs, 62% of SMBs reported workflow-tool ROI inside 12 months.

Key Takeaways

• Building blocks are RFC 8693 (Token Exchange, January 2020) and RFC 7523 (JWT Profile for OAuth grants, May 2015), on top of RFC 6749.

• Duende's recap also flags the human-in-the-loop draft draft-rosomakho-oauth-txn-challenge and the transaction-token chaining profile — related, not this spec.

• The draft's example token-exchange response uses "expires_in": 60 seconds for the JWT authorization grant in the worked example — an illustration, not a mandated lifetime.

• ID-JAG is a profile of this chaining pattern for identity-assertion grants. Agent SSO is a product on top of a profile.

• Teams already routing cross-app calls through US Tech Automations agentic workflows will treat chaining as the hop contract, not a new login screen — same as form-to-CRM automation already assuming one identity at capture.

What OAuth Identity Chaining is, in one sentence

OAuth Identity Chaining is a standardized way for a client in trust domain A to exchange a token at A's authorization server for a short-lived JWT grant, then present that grant at trust domain B's authorization server to get an access token, carrying who authorized the original request across the boundary. That is the entity. It is not Okta, not Duende IdentityServer as a SKU, and not a dashboard.

A 2-truck HVAC shop feels this when the dispatch app in one vendor's cloud calls a parts API in another: today the parts API sees a service account, not the technician. A 10-person agency feels it when a productionizer in AWS calls a client's DAM in Azure. A solo clinic feels it when a billing add-on calls the clearinghouse. Chaining is how the downstream side can still say "this was Dr. X's session, narrowed to this scope." If you never cross a trust domain, you do not need this RFC. The reason to read it is that agents make those crossings the default.

What changed in summer 2026

Joe DeCock's Duende recap dated 20 August 2026: the IETF's OAuth Identity and Authorization Chaining Across Domains received IESG approval and is on track as a Proposed Standard. He counted more than 70 individual drafts proposed for the IETF OAuth working group alone.

The datatracker document shows draft-17, 19 July 2026, RFC Editor queue / IANA OK / Expert Reviews OK / Awaiting First editor in the status table. History records RPC status changes on 13, 19, and 21 August 2026 around editor assignment.

That is a status change on a specification. It does not ship a feature in your IdP the same afternoon. Duende says you can build it today with IdentityServer extension grants (token exchange) without a committed product date.

The other two summer milestones in the same recap: the Transaction Authorization Challenge draft (human-in-the-loop, requires RFC 9396 RAR), and the Transaction Token Authorization Grant Profile for calling a partner without leaking internal transaction tokens.

Sources: datatracker identity-chaining; Duende 20 Aug 2026; RFC 8693; RFC 7523.

How the six-step flow works

The draft's Figure 1:

1. Client in domain A discovers domain B's authorization server (RFC 9728 resource metadata, or a static map).

2. Client exchanges a token it already has at domain A's AS using RFC 8693. resource or audience must identify domain B. One of those two is required.

3. Domain A returns a JWT authorization grant. aud in that JWT must identify domain B's AS. Short-lived; the example uses 60 seconds expires_in.

4. Client presents the grant to domain B with grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer (RFC 7523).

5. Domain B validates the JWT (iss, aud, signature via domain A's keys / jwks_uri) and returns an access token.

6. Client calls the protected resource in domain B.

Claims can be transcribed: subject identifiers differ across domains (johndoe@a.example versus doe.john@b.example); data minimization can drop "account type: premium" and keep "transaction limit: $10,000" in the draft's financial example; scopes can be downscoped.

Security considerations in the draft: client authentication; sender-constraining tokens per RFC 9700; authorized use of the subject token before issuing the grant; SHOULD NOT issue refresh tokens across domains in this flow; short-lived, single-use grants to limit replay.

Appendix use cases: multi-cloud user context, CI accessing external resources, a camera API for partners, extending SSO to API access, an email client talking to an arbitrary calendar API.

Why now: agents multiplied domain hops

Duende's framing: an AI agent pipeline is structurally a chain of trust-domain crossings. Without a standard, each hop is a blind spot.

According to Duende, more than 70 drafts were in flight in the OAuth WG, and identity chaining is the plumbing that makes authorized hops provable.

According to RFC 8693, token exchange already existed as a Proposed Standard in 2020; what was missing was the interoperable cross-domain grant pattern now in draft-17.

According to RFC 7523, the JWT bearer grant has been a Standards Track RFC since May 2015 — chaining reuses it rather than inventing a third grant.

ID-JAG then profiles this for the "SSO IdP brokers API access" shape that Nango and MCP EMA shipped in June 2026.

Clio-class legal tools that call a third-party e-sign API are the SMB version of Appendix A.5.

USTA analysis: example grant lifetime versus a human session

USTA analysis. Inputs from draft-17's worked example only: token-exchange response "expires_in": 60 seconds for the JWT authorization grant, and a matching access-token example also using 60 seconds. Duende's recap does not replace those example numbers.

60 seconds is 1/60 of an hour and 1/1,440 of a 24-hour day. If an agent made one cross-domain call per minute for an eight-hour workday, a 60-second grant implies a fresh exchange up to 480 times per day per agent (8 × 60). That is a count of possible exchanges under the example lifetime, not a requirement in the spec — the draft says implementations may choose lifetimes and single-use rules.

The analysis shows why this is not "SSO for APIs" in the cookie sense. A 60-second grant is closer to a one-shot ticket. SMB tools that copy the example literally will hammer token endpoints; tools that issue hour-long grants increase replay risk, which section 5.5 of the draft tells them to mitigate. Pick the lifetime on purpose.

Who this is for in an SMB shop

If you only use one SaaS suite with one login, ignore the RFC number. Ask whether your vendor uses ID-JAG when an agent calls a second app.

If you build or buy an integration that calls a partner API, ask whether the partner accepts a JWT bearer grant from your IdP or still wants a static key.

If you run Duende IdentityServer, DeCock says token exchange is already an extension point.

Shops already linking systems in US Tech Automations workflows should label each hop "same domain" or "cross domain" and refuse silent key reuse on the cross-domain hops.

When US Tech Automations agents fan out from intake to a partner API, the grant belongs on that fan-out, not on the form.

Signal vs Speculation

Demonstrated fact (sourced). Draft-17 exists, dated 19 July 2026, on the RFC Editor path after IESG approval per Duende (20 August 2026) and datatracker history in August 2026. It combines RFC 8693 and RFC 7523. Example expires_in is 60 seconds. Refresh tokens across domains are discouraged. ID-JAG is a related profile, not a replacement RFC. This is not a product.

Our read: over 12–36 months, SMB teams will never say "identity chaining." They will see "the agent can reach the partner app without a new login" in Okta, Entra, Auth0, or Duende release notes. The risk is vendors claiming chaining while still minting long-lived keys. The test is: can domain B verify domain A's signature and name the original user? If not, it is not this spec. Human-in-the-loop (txn-challenge) will matter more for money movement than chaining itself. Do not wait for the RFC number to appear in an HVAC app's changelog.

FAQ

What is OAuth Identity Chaining?

OAuth Identity Chaining is the IETF specification for preserving identity and authorization across OAuth trust domains by exchanging a token for a JWT grant in domain A and redeeming it in domain B.

Is it a finished RFC?

Not as of this writing. Duende reported IESG approval and a path to Proposed Standard in August 2026; the public text is still an Internet-Draft (revision 17).

How is this different from ID-JAG?

ID-JAG is a profile of the chaining pattern that starts from an identity assertion (ID token or SAML) and targets a resource authorization server both apps already trust for SSO.

Do small businesses implement this themselves?

Usually no. They inherit it when their IdP and SaaS vendors implement the grant. The action is to ask those vendors, in writing, with a date.

Why are refresh tokens discouraged here?

The draft warns that a refresh token in domain B would let the client keep getting access after the domain A session ended (logout or revoke). Re-present the grant instead.

What to do this week

Send one email to your IdP vendor: "Do you issue JWT authorization grants for identity chaining / ID-JAG today, and which resource servers accept them?" File the reply next to your connector list.

Homepage: ustechautomations.com. To mark cross-domain hops in a workflow, open the agentic workflow builder.