Token exchange endpoint wired for RFC 8693 OAuth flows

Summary

Establishes the API contract for the token-exchange flow. Reviewers can see the endpoint shape, request validation, esponse format, and audit event structure before any real token-issuance logic lands.

What's included:

• POST /auth/oauth/token controller — validates an application/x-www-form-urlencoded RFC 8693 token exchange request and returns a well-formed RFC 8693 response. Two-stage validation distinguishes unsupported_grant_type (wrong/missing grant_type) from invalid_request (other schema violations).
• TokenExchangeService stub — returns a placeholder response; will be replaced with real token issuance in a follow-up ticket.
• TokenExchangeAuditEvent discriminated union (token_exchange_success, token_exchange_failure, embed_login) and the three corresponding n8n audit event names / relay handlers wired into log-streaming.event-relay.ts.
• TokenExchangeModule — gated behind feat:tokenExchange license flag (LICENSE_FEATURES.TOKEN_EXCHANGE) so the endpoint only initialises on licensed enterprise instances.
• N8N_TOKEN_EXCHANGE_ENABLED feature flag (default false) — even on a licensed instance, the endpoint returns 501 server_error until the flag is explicitly enabled.
• 'token-exchange' registered as a named module in ModuleRegistry / ModulesConfig.

Files changed:

Area	Files
New module	token-exchange.controller.ts, .service.ts, .module.ts, .types.ts
Config	@n8n/config — new TokenExchangeConfig, wired into GlobalConfig.tokenExchange
License feature	@n8n/constants — LICENSE_FEATURES.TOKEN_EXCHANGE = 'feat:tokenExchange'
Audit events	relay.event-map.ts, event-message-classes/index.ts, log-streaming.event-relay.ts
Module registry	modules.config.ts, module-registry.ts
E2E fixture	e2e.controller.ts — exhaustive BooleanLicenseFeature map updated

Manual testing

Start n8n with the license flag and feature flag enabled:

N8N_TOKEN_EXCHANGE_ENABLED=true \
N8N_LICENSE_ACTIVATION_KEY=<your-enterprise-key> \
pnpm start

---

1. Feature flag disabled (default) — expect 501

curl -s -X POST http://localhost:5678/rest/auth/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=test' \
  | jq .
# → { "error": "server_error", "error_description": "Token exchange is not enabled on this instance" }

---

2. Wrong grant_type — expect 400 unsupported_grant_type

curl -s -X POST http://localhost:5678/rest/auth/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials&subject_token=test' \
  | jq .
# → { "error": "unsupported_grant_type", "error_description": "..." }

---

3. Missing subject_token — expect 400 invalid_request

curl -s -X POST http://localhost:5678/rest/auth/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \
  | jq .
# → { "error": "invalid_request", "error_description": "..." }

---

4. Valid request (stub) — expect 200 RFC 8693 response

curl -s -X POST http://localhost:5678/rest/auth/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyMSJ9.sig' \
  | jq .
# → {
#     "access_token": "stub-access-token",
#     "token_type": "Bearer",
#     "expires_in": 3600,
#     "issued_token_type": "urn:ietf:params:oauth:token-type:access_token"
#   }

---

5. Valid request with optional fields

curl -s -X POST http://localhost:5678/rest/auth/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange' \
  --data-urlencode 'subject_token=eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyMSJ9.sig' \
  --data-urlencode 'subject_token_type=urn:ietf:params:oauth:token-type:jwt' \
  --data-urlencode 'scope=openid profile' \
  --data-urlencode 'audience=https://api.example.com' \
  | jq .

---

6. Unlicensed instance — module should not initialise

Start n8n without a license (or without feat:tokenExchange) and confirm the endpoint returns 404:

curl -s -o /dev/null -w "%{http_code}" \
  -X POST http://localhost:5678/rest/auth/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=urn:ietf:params:oauth:grant-type:token-exchange&subject_token=test'
# → 404

Related Linear tickets, Github issues, and Community forum posts

https://linear.app/n8n/issue/IAM-459

Review / Merge checklist

• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with release/backport (if the PR is an urgent fix that needs to be backported)