An invalid subject token error occurs during an OAuth 2.0 On-Behalf-Of Token Exchange because the Okta Authorization Server cannot validate the token. Resolve this issue by inspecting the token claims to ensure the token remains unexpired and the audience and issuer match the expected values. When an application attempts to perform an OAuth 2.0 On-Behalf-Of Token Exchange using the grant type urn:ietf:params:oauth:grant-type:token-exchange, the request to the /token endpoint fails, and Okta returns the following error:

{ "error": "invalid_grant", "error_description": "subject token is invalid" }

• Okta Identity Engine (OIE)
• Okta Classic Engine
• OAuth 2.0 / OpenID Connect (OIDC)
• Token Exchange Grant Type

This error occurs because the Okta Authorization Server cannot validate the subject_token. There are several common causes for this validation failure:

• Expired token: The subject_token is expired. The expiration time is checked via the exp claim.
• Invalid Audience: The aud (audience) claim in the subject_token is not the client_id of the application that is making the token exchange request. 
• Issuer mismatch: The iss (issuer) of the token is for a different authorization server than the authorization server of the token endpoint being called.

What steps resolve the subject token validation failure?

Inspect the subject_token (for example, using a tool like jwt.io)  to confirm the claims are correct by verifying the expiration, audience, and issuer values.

• Check the exp claim to ensure the token remains unexpired.
• Check the aud claim to verify that this claim exactly matches the Client ID of the application making the request to the /token endpoint.
• Check the iss claim to confirm that the authorization server in the issuer claim matches the authorization server used in the token call.

Related References

• Set up Oauth 2.0 On-Behalf-Of Token Exchange