All IAM glossary termsAuthorization · glossary
OBO Flow (On-Behalf-Of)
Also known as: On-Behalf-Of · OBO Token Exchange
Definition
The On-Behalf-Of (OBO) flow (RFC 8693 Token Exchange) lets a middle-tier service exchange a received user token for a new token to call a downstream API on behalf of the originating user.
In more depth
OBO is essential in tiered API architectures. The user authenticates to Service A. Service A needs to call Service B downstream — but Service B needs to know the original user identity. OBO uses Token Exchange to swap the inbound token for a new one targeted at Service B, preserving user context.
Microsoft Entra calls this "On-Behalf-Of flow"; standards-track is RFC 8693 Token Exchange. Common in zero-trust microservice architectures.
Want the work, not just the definition?