This specification provides a mechanism for an application to use an identity assertion to obtain an access token for a third-party API using Token Exchange and JWT Profile for OAuth 2.0 Authorization Grants .