Struct TokenExchangeConfig 

pub struct TokenExchangeConfig {
    pub exchange_url: String,
    pub client_id: String,
    pub client_secret: String,
    pub tenant_id: Option<String>,
    pub agent_token: String,
    pub scopes: Vec<String>,
}

RFC 8693 Token Exchange configuration for per-user MCP auth delegation.

When configured, each task submitted with a JWT gets a user-scoped delegated token injected into MCP requests. The daemon acts as the agent (actor) and exchanges the user’s subject token for a scoped access token.

Fields

exchange_url: String

Token exchange endpoint URL (e.g. "https://idp.example.com/oauth/token").

client_id: String

OAuth client ID for the daemon/agent.

client_secret: String

OAuth client secret for the daemon/agent.

tenant_id: Option<String>

NHI tenant ID — used for X-Tenant-ID header in client_credentials grant. When set, agent_token is fetched and cached automatically; no static token needed.

agent_token: String

Static fallback agent token (actor_token in RFC 8693). Used only when tenant_id is absent (backward-compat).

scopes: Vec<String>

OAuth scopes to request for the delegated token. Defaults to empty.

Trait Implementations

impl Clone for TokenExchangeConfig

fn clone(&self) -> TokenExchangeConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TokenExchangeConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for TokenExchangeConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.