Okta does not require the Token Exchange grant type for the OpenID Connect (OIDC) Web App used as the User Sign-On App in the Okta for AI Agents configuration. The AI Agent workload principal facilitates the token exchange calls requiring that grant type natively.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta for AI Agents
• OpenID Connect (OIDC)

Is the Token Exchange grant type required for the OpenID Connect Web App?

Okta does not require the Token Exchange grant type for the OIDC Web App used as the User Sign-On App in the AI Agents configuration. The AI Agent workload principal, which is the Client ID of the Agent, facilitates the token exchange calls requiring that grant type. The AI Agent supports this natively.