# AWS adds native on-behalf-of token exchange to AgentCore Gateway for ServiceNow

Digest AI · Agents & Tools · published 2026-11-03T16:47:40Z

Canonical: https://digestai.news/story/aws-adds-native-on-behalf-of-token-exchange-to-agentcore-gateway-for-s

## Summary

AWS published a walkthrough showing how to configure Amazon Bedrock AgentCore Gateway to perform on-behalf-of (OBO) token exchanges with Microsoft Entra ID so that AI agents can call the ServiceNow REST API while preserving the original user's identity. The pattern uses two Entra application registrations — one for the agent and one for the ServiceNow API connector — and requires MCP version 2025-11-25 on the gateway. AgentCore Gateway handles the token exchange transparently on each request, removing the need for custom Lambda interceptors. The post includes step-by-step configuration for Entra ID, ServiceNow inbound OAuth, and the gateway target with the required scope (api://<connector-client-id>/userimpersonation) and the custom parameter requestedtokenuse:onbehalfof. The same pattern can be applied to other REST APIs protected by OAuth.

## Key points

- AgentCore Gateway now performs OBO token exchange natively with Microsoft Entra ID
- Requires MCP version 2025-11-25 and two Entra app registrations
- Preserves user identity when agents call ServiceNow REST API

## Why it matters

Eliminates custom code for identity propagation in agent-to-enterprise-API calls, enabling audit trails and user-level access controls.

## Sources

1. [ServiceNow on-behalf-of token exchange with Bedrock AgentCore Gateway](https://aws.amazon.com/blogs/machine-learning/servicenow-on-behalf-of-token-exchange-with-bedrock-agentcore-gateway) (AWS Machine Learning Blog, 2026-11-03, primary source)

Part of the developing story: [Amazon Bedrock Enterprise AI Agent Ecosystem Expansion](https://digestai.news/thread/octave-reliance-builds-secure-multi-tenant-ai-foundation-on-amazon-bedrock) (5 stories)

## Cite

Digest AI, "AWS adds native on-behalf-of token exchange to AgentCore Gateway for ServiceNow", 3 November 2026, https://digestai.news/story/aws-adds-native-on-behalf-of-token-exchange-to-agentcore-gateway-for-s

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/aws-adds-native-on-behalf-of-token-exchange-to-agentcore-gateway-for-s.json