As specified in the google documentation proposal , we may add the switch to the client whether token-exchange grant is supported for the particular client. This should be present on the "requester" clients. Probably should be same admin console section when we have all other grants (Standard flow, Direct grant, Implicit flow etc).

It should be make clear from the hint of this switch (and also from the documentation) that switch is related only to "Standard token-exchange V2", which we aim to support in Keycloak 26.2. As the switch may not be needed for other token-exchange providers (like token-exchange V1 or federated-token-exchange V2 or subject-impersonation-token-exchange V2).