System and method for delegating authority through coupled devices

In a cloud service, a method of authenticating an Internet of Things (IoT) device having an IoT device identity to a second service that does not natively support the IoT device identity, the method comprising:

• receiving, by one or more processors, a request for access to the second service;
• receiving, by the one or more processors, a first token from the IoT device for authenticating the IoT device;
• validating, by the one or more processors, the first token by using information associated with an IoT account;
• inserting, by the one or more processors, one or more claims into the first token, thereby creating a custom token;
• exchanging, by the one or more processors, the custom token for an access token, wherein the access token is generated in response to the first token being valid, the access token being usable as a credential for the second service, the access token having a valid time window and an authorization scope restricted by the claims;
• and
• providing the access token to the IoT device for use in accessing the second service during the time window without validating a second credential specific to the second service.