[keycloak-user] Refreshing exchanged token

Hi all, I have a problem refreshing an exchanged token, and I would need some help to understand if I'm doing something wrong. I have two test confidential clients, client_1 and client_2, and client_1 is allowed to exchange tokens for client_2. First, I get a token for client_1, then I use token exchange to get a token for client_2. The token that I have at this point looks like this (snipped): session_state: 30b295b9-7278-4c9e-b5c4-0927e111a676 token_type: bearer access_token (decoded claims) : aud = client_2 clientId = client_1 refresh_token (decoded claims) : aud = client_2 azp = client_1 So far, everything is fine, but the problem is when I try to refresh the token for client_2 I got from the previous call. The call I'm making is POST https://<server>/auth/realms/master/protocol/openid-connect/token client_id = client_1 client_secret = <client secret for client_1> grant_type = refresh_token refresh_token = <the refresh_token string from the exchanged token> What I would expect is to get a new token with aud = client_2, instead I get a new token with aud = client_1: session_state: 30b295b9-7278-4c9e-b5c4-0927e111a676 token_type: bearer access_token: aud = client_1 clientId = client_1 refresh_token: aud = client_1 azp = client_1 Is this correct? Should I just get a new token through token exchange in this case, instead of refreshing the existing one? Thanks, Paolo Tedesco