Token Exchange
The Trust Domain Server exposes an /oauth/token endpoint that exchanges a credential a workload already holds for a different credential.
Delegation
Exchange a user's token for a delegated JWT-SVID.
OAuth Access Tokens
Exchange a JWT-SVID for an OAuth access token.