Best Practice for Cross-Instance Token Exchange with Shared IdP (Okta) #45598

webframeworkhalliburton · 2026-01-20T09:52:50Z

webframeworkhalliburton
Jan 20, 2026

We are currently running Keycloak v26.2 and have a use case that requires exchanging tokens between different Keycloak instances (external-to-internal flow) that share a common identity provider (Okta).

Current Situation:

Token Exchange v1 worked reliably until Keycloak v25
From v26 onwards, Token Exchange v1 is in preview state and requires explicit enablement via --features=token-exchange
We have temporarily enabled this feature to maintain existing functionality

Challenge:

Token Exchange v1 is deprecated and scheduled for removal in Keycloak v27
Token Exchange v2 (Standard Token Exchange) only supports internal-to-internal flows within the same realm
Our use case (cross-instance exchange with shared IdP) is not currently supported by v2

What is the recommended approach for achieving cross-instance token exchange with a shared IdP in Keycloak v26.2+? Are there alternative patterns or best practices we should consider to future-proof our implementation?

Any guidance would be greatly appreciated.

Navigation Menu

Repository navigation

Best Practice for Cross-Instance Token Exchange with Shared IdP (Okta) #45598

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Best Practice for Cross-Instance Token Exchange with Shared IdP (Okta) #45598

Uh oh!

webframeworkhalliburton Jan 20, 2026

Replies: 0 comments

webframeworkhalliburton
Jan 20, 2026