#### [Abblix\.Oidc\.Server](https://www.abblix.com/en/docs/api/abblix-oidc-server 'index')
### [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants')

## TokenExchangeGrantHandler Class

[IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') for RFC 8693 Token Exchange
            \(`grant_type=urn:ietf:params:oauth:grant-type:token-exchange`\)\.

```csharp
public class TokenExchangeGrantHandler : Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler, Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → TokenExchangeGrantHandler

Implements [IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler'), [IGrantTypeInformer](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer')

### Remarks
Per\-format subject\-token validation is delegated to keyed [ISubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.ISubjectTokenResolver')
implementations: [JwtSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.JwtSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.JwtSubjectTokenResolver') for the three JWT\-based type URIs
\(`access_token`, `id_token`, `jwt`\) and
[RefreshTokenSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.RefreshTokenSubjectTokenResolver') for refresh tokens\. Lookup that returns no
resolver for the requested key yields `invalid_request` \-\- the library never silently
accepts an unknown `subject_token_type`\. Hosts may register additional resolvers for
formats this library does not handle natively\.

Authorization is structured as a monadic `Bind`-chain on
[Abblix\.Utils\.Result<>](https://learn.microsoft.com/en-us/dotnet/api/abblix.utils.result-2 'Abblix\.Utils\.Result\`2'), mirroring [JwtBearerGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.JwtBearerGrantHandler'): each
step returns either an enriched [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler\.ValidationContext](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.endpoints.token.grants.tokenexchangegranthandler.validationcontext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler\.ValidationContext') or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError');
the chain short-circuits at the first failure. Subject-token resolution sits in the middle
of the chain, so post-resolve guards (cross-client origin, typ-confusion, forwarded AD
allowlist) read the resolved [SubjectTokenContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.SubjectTokenContext') directly from the context.

Supports both RFC 8693 §4.1 modes: impersonation (no `actor_token`; the issued token's
`sub` equals the subject_token's subject, no `act` claim) and delegation
(`actor_token` provided; the issued token's `sub` still equals the subject's
subject, and the `act` claim names the actor. When the subject_token itself already
carries an `act` chain, the new actor is layered on top -- the previous chain becomes
the new actor's nested `act.act`).
### Constructors

## TokenExchangeGrantHandler\(IServiceProvider, ISessionIdGenerator, TimeProvider\) Constructor {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.TokenExchangeGrantHandler(System.IServiceProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider)}

[IAuthorizationGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler') for RFC 8693 Token Exchange
            \(`grant_type=urn:ietf:params:oauth:grant-type:token-exchange`\)\.

```csharp
public TokenExchangeGrantHandler(System.IServiceProvider serviceProvider, Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator sessionIdGenerator, System.TimeProvider timeProvider);
```
#### Parameters

###### `serviceProvider` [System\.IServiceProvider](https://learn.microsoft.com/en-us/dotnet/api/system.iserviceprovider 'System\.IServiceProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.TokenExchangeGrantHandler(System.IServiceProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider).serviceProvider}

###### `sessionIdGenerator` [ISessionIdGenerator](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator 'Abblix\.Oidc\.Server\.Features\.RandomGenerators\.ISessionIdGenerator') {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.TokenExchangeGrantHandler(System.IServiceProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider).sessionIdGenerator}

###### `timeProvider` [System\.TimeProvider](https://learn.microsoft.com/en-us/dotnet/api/system.timeprovider 'System\.TimeProvider') {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.TokenExchangeGrantHandler(System.IServiceProvider,Abblix.Oidc.Server.Features.RandomGenerators.ISessionIdGenerator,System.TimeProvider).timeProvider}

### Remarks
Per\-format subject\-token validation is delegated to keyed [ISubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.ISubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.ISubjectTokenResolver')
implementations: [JwtSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.JwtSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.JwtSubjectTokenResolver') for the three JWT\-based type URIs
\(`access_token`, `id_token`, `jwt`\) and
[RefreshTokenSubjectTokenResolver](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.RefreshTokenSubjectTokenResolver 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.RefreshTokenSubjectTokenResolver') for refresh tokens\. Lookup that returns no
resolver for the requested key yields `invalid_request` \-\- the library never silently
accepts an unknown `subject_token_type`\. Hosts may register additional resolvers for
formats this library does not handle natively\.

Authorization is structured as a monadic `Bind`-chain on
[Abblix\.Utils\.Result<>](https://learn.microsoft.com/en-us/dotnet/api/abblix.utils.result-2 'Abblix\.Utils\.Result\`2'), mirroring [JwtBearerGrantHandler](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.JwtBearerGrantHandler 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.JwtBearerGrantHandler'): each
step returns either an enriched [Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler\.ValidationContext](https://learn.microsoft.com/en-us/dotnet/api/abblix.oidc.server.endpoints.token.grants.tokenexchangegranthandler.validationcontext 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler\.ValidationContext') or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError');
the chain short-circuits at the first failure. Subject-token resolution sits in the middle
of the chain, so post-resolve guards (cross-client origin, typ-confusion, forwarded AD
allowlist) read the resolved [SubjectTokenContext](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.TokenExchange.SubjectTokenContext 'Abblix\.Oidc\.Server\.Features\.TokenExchange\.SubjectTokenContext') directly from the context.

Supports both RFC 8693 §4.1 modes: impersonation (no `actor_token`; the issued token's
`sub` equals the subject_token's subject, no `act` claim) and delegation
(`actor_token` provided; the issued token's `sub` still equals the subject's
subject, and the `act` claim names the actor. When the subject_token itself already
carries an `act` chain, the new actor is layered on top -- the previous chain becomes
the new actor's nested `act.act`).
### Properties

## TokenExchangeGrantHandler\.GrantTypesSupported Property {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.GrantTypesSupported}

The grant types supported by this component, as defined in OAuth 2\.0 and OpenID Connect specifications\.

```csharp
public System.Collections.Generic.IEnumerable<string> GrantTypesSupported { get; }
```

Implements [GrantTypesSupported](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer#Abblix.Oidc.Server.Common.Interfaces.IGrantTypeInformer.GrantTypesSupported 'Abblix\.Oidc\.Server\.Common\.Interfaces\.IGrantTypeInformer\.GrantTypesSupported')

#### Property Value
[System\.Collections\.Generic\.IEnumerable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.ienumerable-1 'System\.Collections\.Generic\.IEnumerable\`1')

### Remarks
Common grant types include:
- "authorization_code" - Authorization Code Grant
- "implicit" - Implicit Grant
- "refresh_token" - Refresh Token Grant
- "client_credentials" - Client Credentials Grant
- "password" - Resource Owner Password Credentials Grant
### Methods

## TokenExchangeGrantHandler\.AuthorizeAsync\(TokenRequest, ClientInfo\) Method {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo)}

Resolves the grant\-specific input from [request](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).request 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.TokenExchangeGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)\.request') \(authorization code,
refresh token, device code, client credentials, JWT assertion, etc\.\) into the
[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant') that will drive token issuance, or an [OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')
such as `invalid_grant`, `authorization_pending`, or `slow_down`\.

```csharp
public System.Threading.Tasks.Task<Abblix.Utils.Result<Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant,Abblix.Oidc.Server.Common.OidcError>> AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest request, Abblix.Oidc.Server.Features.ClientInformation.ClientInfo clientInfo);
```
#### Parameters

###### `request` [TokenRequest](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Model.TokenRequest 'Abblix\.Oidc\.Server\.Model\.TokenRequest') {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).request}

The token request \(already authenticated against the client\)\.

###### `clientInfo` [ClientInfo](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Features.ClientInformation.ClientInfo 'Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo') {#Abblix.Oidc.Server.Endpoints.Token.Grants.TokenExchangeGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo).clientInfo}

The authenticated client; used to enforce that the grant was
            issued to the same client that is now redeeming it\.

Implements [AuthorizeAsync\(TokenRequest, ClientInfo\)](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler#Abblix.Oidc.Server.Endpoints.Token.Grants.IAuthorizationGrantHandler.AuthorizeAsync(Abblix.Oidc.Server.Model.TokenRequest,Abblix.Oidc.Server.Features.ClientInformation.ClientInfo) 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Grants\.IAuthorizationGrantHandler\.AuthorizeAsync\(Abblix\.Oidc\.Server\.Model\.TokenRequest, Abblix\.Oidc\.Server\.Features\.ClientInformation\.ClientInfo\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[Abblix\.Utils\.Result&lt;](https://learn.microsoft.com/en-us/dotnet/api/abblix.utils.result-2 'Abblix\.Utils\.Result\`2')[AuthorizedGrant](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Endpoints.Token.Interfaces.AuthorizedGrant 'Abblix\.Oidc\.Server\.Endpoints\.Token\.Interfaces\.AuthorizedGrant')[,](https://learn.microsoft.com/en-us/dotnet/api/abblix.utils.result-2 'Abblix\.Utils\.Result\`2')[OidcError](https://www.abblix.com/en/docs/api/abblix-oidc-server/Abblix.Oidc.Server.Common.OidcError 'Abblix\.Oidc\.Server\.Common\.OidcError')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/abblix.utils.result-2 'Abblix\.Utils\.Result\`2')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')