{"version":1,"type":"story","url":"https://digestai.news/story/aws-adds-native-on-behalf-of-token-exchange-to-agentcore-gateway-for-s","json":"https://digestai.news/story/aws-adds-native-on-behalf-of-token-exchange-to-agentcore-gateway-for-s.json","markdown":"https://digestai.news/story/aws-adds-native-on-behalf-of-token-exchange-to-agentcore-gateway-for-s.md","slug":"aws-adds-native-on-behalf-of-token-exchange-to-agentcore-gateway-for-s","headline":"AWS adds native on-behalf-of token exchange to AgentCore Gateway for ServiceNow","summary":"AWS published a walkthrough showing how to configure Amazon Bedrock AgentCore Gateway to perform on-behalf-of (OBO) token exchanges with Microsoft Entra ID so that AI agents can call the ServiceNow REST API while preserving the original user's identity. The pattern uses two Entra application registrations — one for the agent and one for the ServiceNow API connector — and requires MCP version 2025-11-25 on the gateway. AgentCore Gateway handles the token exchange transparently on each request, removing the need for custom Lambda interceptors. The post includes step-by-step configuration for Entra ID, ServiceNow inbound OAuth, and the gateway target with the required scope (api://<connector-client-id>/userimpersonation) and the custom parameter requestedtokenuse:onbehalfof. The same pattern can be applied to other REST APIs protected by OAuth.","keyPoints":["AgentCore Gateway now performs OBO token exchange natively with Microsoft Entra ID","Requires MCP version 2025-11-25 and two Entra app registrations","Preserves user identity when agents call ServiceNow REST API"],"whyItMatters":"Eliminates custom code for identity propagation in agent-to-enterprise-API calls, enabling audit trails and user-level access controls.","category":{"slug":"agents","name":"Agents & Tools","url":"https://digestai.news/category/agents"},"entities":{"companies":["AWS","Amazon","Microsoft","ServiceNow"],"models":[],"people":[]},"firstPublishedAt":"2026-11-03T16:47:40Z","updatedAt":"2026-11-03T16:47:40Z","sourceCount":1,"hasPrimarySource":true,"sources":[{"outlet":"AWS Machine Learning Blog","title":"ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway","url":"https://aws.amazon.com/blogs/machine-learning/servicenow-on-behalf-of-token-exchange-with-bedrock-agentcore-gateway","publishedAt":"2026-11-03T16:47:40Z","type":"primary","primary":true,"lead":true}],"sourceNotes":null,"discussions":[],"thread":{"title":"Amazon Bedrock Enterprise AI Agent Ecosystem Expansion","url":"https://digestai.news/thread/octave-reliance-builds-secure-multi-tenant-ai-foundation-on-amazon-bedrock","storyCount":5},"cite":{"text":"Digest AI, \"AWS adds native on-behalf-of token exchange to AgentCore Gateway for ServiceNow\", 3 November 2026, https://digestai.news/story/aws-adds-native-on-behalf-of-token-exchange-to-agentcore-gateway-for-s","publisher":"Digest AI","title":"AWS adds native on-behalf-of token exchange to AgentCore Gateway for ServiceNow","datePublished":"2026-11-03T16:47:40Z","url":"https://digestai.news/story/aws-adds-native-on-behalf-of-token-exchange-to-agentcore-gateway-for-s"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}