identityserver-token-lifecycle

Manage token types, refresh token rotation, and RFC 8693 token exchange in Duende IdentityServer.

10|2|Updated Mar 16, 2026

Search Tags:#claims #token-exchange #token-lifecycle #refresh-tokens #identityserver #extension-grants #iprofileservice

Ready to run

npx skills add https://github.com/DuendeSoftware/duende-skills --skill identityserver-token-lifecycle

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: identityserver-token-lifecycle
Source: https://github.com/DuendeSoftware/duende-skills/tree/main/skills/identityserver-token-lifecycle
Command: npx skills add https://github.com/DuendeSoftware/duende-skills --skill identityserver-token-lifecycle

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Auth and authorization flows rely on accurate token lifecycles; this skill provides a guided approach to token types, refresh tokens, and token exchange in Duende IdentityServer.

Core Features & Use Cases

Token types overview (Identity tokens, Access tokens, Refresh tokens) and how they are used in client-server scenarios.
Refresh token rotation, sliding expiration, and RFC 8693 token exchange for impersonation or delegation.
Extension grants (IExtensionGrantValidator) and IProfileService claims customization to tailor issued tokens.

Quick Start

Configure IdentityServer to enable token types, refresh token rotation, and RFC 8693 token exchange in a minimal, production-ready setup.

Frequently Asked Questions about identityserver-token-lifecycle

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I configure refresh token rotation in Duende IdentityServer?▼

Refresh token rotation in Duende IdentityServer is configured by setting token lifecycle policies that enforce sliding expiration, issuing a new token on each use while invalidating the old one to enhance security.

What is RFC 8693 token exchange and how does it work for impersonation?▼

RFC 8693 token exchange allows Duende IdentityServer to issue new tokens for impersonation or delegation scenarios, exchanging an existing access token for a new one with different scopes or claims tailored to the downstream service.

How do I customize claims in issued access tokens using IProfileService?▼

IProfileService claims customization in Duende IdentityServer allows you to inject, filter, or transform claims into identity and access tokens during token issuance, tailoring token content to specific client or API security requirements.

When do I need extension grants and IExtensionGrantValidator in IdentityServer?▼

Extension grants using IExtensionGrantValidator are needed when standard OAuth flows are insufficient, enabling Duende IdentityServer to support custom token exchange or non-standard authentication mechanisms for specialized interoperability.

What are the differences between identity tokens and access tokens in token lifecycles?▼

Identity tokens authenticate the user and contain profile claims, while access tokens authorize API access. Managing their token lifecycles in Duende IdentityServer involves setting distinct lifetime policies and expiration behaviors for each type.

Can I use token exchange for delegation flows in a production IdentityServer setup?▼

Yes, token exchange for delegation is supported in production-ready Duende IdentityServer setups. It uses RFC 8693 and extension grants to safely pass user context securely across downstream API boundaries.