External-to-Internal token exchange

See my answer here regarding deprecated legacy token exchange and external-to-internal-exchange: