Amazon Bedrock AgentCore Identity now supports On-Behalf-Of (OBO) token exchange

This article announces that Amazon Bedrock AgentCore Identity now supports On-Behalf-Of (OBO) token exchange, enabling secure agent access to protected resources on behalf of authenticated users.

• Agents can exchange access tokens for scoped-down tokens with user and agent identity
• Eliminates need for multiple consent flows per protected resource
• Provides just-in-time, least-privilege access without additional user prompts
• Reduces friction for end users and complexity for developers
• Generally available in 14 AWS regions globally

OBO token exchange simplifies agent development by streamlining authentication and authorization for multi-resource access scenarios.