Amazon Cognito now supports OAuth 2.0 token exchange

[Amazon Cognito](https://aws.amazon.com/cognito/) now supports OAuth 2.0 token exchange (RFC 8693). Amazon Cognito helps you add sign-up, sign-in, and access control to your web applications, mobile applications, and AI agents. With token exchange, a service or AI agent acting on a user's behalf can exchange the user's token for a new token scoped to a specific downstream service. Previously, a service that called another service on a user's behalf had to forward the user's original token or build and maintain its own token minting logic. With token exchange, you can issue a new token that has a narrower scope than the original token, is bound to a single audience, and comes without a refresh token. When you include an actor token, Cognito adds an act claim that identifies the intermediary, so downstream services can tell a request that an agent made on a user's behalf from one the user made directly. For example, a Model Context Protocol (MCP) server can exchange a user's token for a narrowly scoped token to call a backend API, with the act claim recording the MCP server as the actor. You can exchange tokens through the token endpoint or with the new [GetDerivedToken API](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API%5FGetDerivedToken.html). Token exchange is available on the Essentials and Plus feature plans in all [AWS Regions](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/) where Amazon Cognito is available. To learn more, see [exchanging tokens for downstream services](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-token-exchange.html) in the Amazon Cognito Developer Guide.