Token Exchange Handlers

Token Exchange Handlers is a Setup page for managing Apex classes that handle OAuth token exchange flows. These handlers implement custom logic for exchanging tokens between identity providers and Salesforce, enabling complex authentication scenarios like token delegation and cross-cloud identity federation.

Standard OAuth flows handle most authentication scenarios cleanly. Modern integrations sometimes need more - token delegation, cross-cloud identity federation, exchange of one token type for another, custom claims processing. Token Exchange Handlers is the Apex extension point where developers implement that custom logic. Define the class, register it as a handler, and the platform invokes it during the relevant OAuth exchange step.

The reason this is a niche capability worth knowing about is that the use cases that need it tend to be high-value. Federation across multi-cloud environments, partner-to-tenant token exchange, scenarios where the standard OAuth grant types don't quite fit - each is a specific integration problem that without this hook would require external infrastructure. Use it sparingly, document it carefully (because the next admin will not have come across it before), and treat each handler as a piece of security-sensitive code worthy of careful review.