> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# exchange

<div>
  <h2>Name</h2>

  <p style={{ paddingLeft: "4ch" }}>
    <code>nebius iam token-exchange exchange</code>
  </p>
</div>

<div>
  <h2>Synopsis</h2>

  <p style={{ paddingLeft: "4ch" }}>
    ```
    nebius iam token-exchange exchange
      --actor-token
      --actor-token-type
      --audience
      --grant-type
      --requested-token-type
      --resource
      --scopes
      --subject-token
      --subject-token-type
    ```
  </p>
</div>

<div>
  <h2>Options</h2>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--actor-token` (string)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Optional, subject token for impersonation/delegation (who want to impersonate/delegate) in subject\_token.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--actor-token-type` (string)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Optional, token type for the impersonation/delegation (who want to impersonate/delegate). Usually it's<br />
      urn:ietf:params:oauth:token-type:access\_token.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--audience` (string)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Optional, name of the oauth client id on which this token will be used.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--grant-type` (string)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Required - urn:ietf:params:oauth:grant-type:token-exchange.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--requested-token-type` (string)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Optional type of requested token, default is urn:ietf:params:oauth:token-type:access\_token.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--resource` (string array)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Optional, list of resources approved to use by token, if applicable.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--scopes` (string array)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Optional (scopes of the token).
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--subject-token` (string)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Required - could be self signed JWT token.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--subject-token-type` (string)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Required, in case of jwt - urn:ietf:params:oauth:token-type:jwt.
    </p>
  </div>
</div>

<div>
  <h2>Global Options</h2>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `-h, --help` (bool)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Show this message.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `-p, --profile` (string)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Set a profile for interacting with the cloud.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--format` (string)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Output format. Supported values: yaml|json|jsonpath|table|text.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `-f, --file` (string)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Input file. For 'update' commands automatically set --full=true.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `-c, --config` (string)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Provide path to config file.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--debug` (bool)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Enable debug logs.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--color` (bool)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Enable colored output.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--no-browser` (bool)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Do not open browser automatically on auth.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--insecure` (bool)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Disable transport security.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--auth-timeout` (duration: 2h30m10s)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Set the timeout for the request including authentication process, default is 15m0s.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--per-retry-timeout` (duration: 2h30m10s)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Set the timeout for each retry attempt, default is 20s.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--retries` (uint)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Set the number of retry attempts, 1 is disable retries, default is 3.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--timeout` (duration: 2h30m10s)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Set the timeout for the main request, default is 1m0s.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--no-check-update` (bool)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Suppress check for updates.
    </p>
  </div>

  <div style={{ paddingLeft: "4ch" }}>
    <p>
      `--no-progress` (bool)
    </p>

    <p style={{ paddingLeft: "4ch" }}>
      Suppress progress indicators and spinners.
    </p>
  </div>
</div>

<Expandable title="Input argument JSON Schema">
  <Tabs>
    <Tab title="Full">
      ```json theme={null}
      {                                
        "actor_token": string,          // [sensitive]
                                        // Optional, subject token for impersonation/delegation (who want to impersonate/delegate) in subject_token.
        "actor_token_type": string,     // Optional, token type for the impersonation/delegation (who want to impersonate/delegate). Usually it's
                                        // urn:ietf:params:oauth:token-type:access_token.
        "audience": string,             // Optional, name of the oauth client id on which this token will be used.
        "grant_type": string,           // Required - urn:ietf:params:oauth:grant-type:token-exchange.
        "requested_token_type": string, // Optional type of requested token, default is urn:ietf:params:oauth:token-type:access_token.
        "resource": [string],           // Optional, list of resources approved to use by token, if applicable.
        "scopes": [string],             // Optional (scopes of the token).
        "subject_token": string,        // [sensitive]
                                        // Required - could be self signed JWT token.
        "subject_token_type": string    // Required, in case of jwt - urn:ietf:params:oauth:token-type:jwt.
      }
      ```
    </Tab>

    <Tab title="CopyPaste Friendly">
      ```json theme={null}
      nebius iam token-exchange exchange '
      {                            
        "actor_token": "",         
        "actor_token_type": "",    
        "audience": "",            
        "grant_type": "",          
        "requested_token_type": "",
        "resource": [""],          
        "scopes": [""],            
        "subject_token": "",       
        "subject_token_type": ""   
      }
      '
      ```
    </Tab>
  </Tabs>
</Expandable>

<strong>Auto generated on 7-May-2026</strong>