Transaction Tokens
Short-lived tokens that propagate authorization context through a chain of microservices.
Sequence Diagram
1
Obtain Subject Token (Prerequisite)
The calling workload obtains an access token from the Authorization Server. This access token serves as the subject_token in the Txn-Token request.
Client App→IdP (Authorization Server)
2
Request Transaction Token from TTS
The calling workload exchanges the access token for a short-lived Transaction Token (Txn-Token) via RFC 8693 Token Exchange. The TTS sets the req_wl claim to identify the requesting workload and binds the token to the Trust Domain.
Client App→Transaction Token Service
3
Access Resource Server with Txn-Token
The calling workload presents the Txn-Token in the Txn-Token HTTP header when calling the Resource Server. The Resource Server validates the typ (txntoken+jwt), aud (Trust Domain), exp, and txn claims before granting access.
Client App→Resource Server