diff --git a/src/Security/Authentication/OAuth/src/Events/OAuthEvents.cs b/src/Security/Authentication/OAuth/src/Events/OAuthEvents.cs
index 9e194491b98b..979ab578186c 100644
--- a/src/Security/Authentication/OAuth/src/Events/OAuthEvents.cs
+++ b/src/Security/Authentication/OAuth/src/Events/OAuthEvents.cs
@@ -25,6 +25,11 @@ public class OAuthEvents : RemoteAuthenticationEvents
             return Task.CompletedTask;
         };
 
+        /// <summary>
+        /// Gets or sets the delegate that is invoked when the ExchangeCode method is invoked.
+        /// </summary>
+        public Func<OAuthExchangeCodeContext, Task> OnExchangeCode { get; set; } = context => Task.CompletedTask;
+
         /// <summary>
         /// Invoked after the provider successfully authenticates a user.
         /// </summary>
@@ -37,5 +42,13 @@ public class OAuthEvents : RemoteAuthenticationEvents
         /// </summary>
         /// <param name="context">Contains redirect URI and <see cref="AuthenticationProperties"/> of the challenge.</param>
         public virtual Task RedirectToAuthorizationEndpoint(RedirectContext<OAuthOptions> context) => OnRedirectToAuthorizationEndpoint(context);
+
+        /// <summary>
+        /// Invoked before the request to exchange the code for the access token.
+        /// </summary>
+        /// <param name="context">Contains the code returned, the redirect URI and the <see cref="AuthenticationProperties"/>.</param>
+        /// <returns></returns>
+        public virtual Task ExchangeCode(OAuthExchangeCodeContext context) => OnExchangeCode(context);
+    
     }
-}
\ No newline at end of file
+}
diff --git a/src/Security/Authentication/OAuth/src/Events/OAuthExchangeCodeContext.cs b/src/Security/Authentication/OAuth/src/Events/OAuthExchangeCodeContext.cs
new file mode 100644
index 000000000000..c4d00a8d5bb9
--- /dev/null
+++ b/src/Security/Authentication/OAuth/src/Events/OAuthExchangeCodeContext.cs
@@ -0,0 +1,38 @@
+// Copyright (c) .NET Foundation. All rights reserved.
+// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
+
+using System.Collections.Generic;
+using Microsoft.AspNetCore.Http;
+
+namespace Microsoft.AspNetCore.Authentication.OAuth
+{
+    /// <summary>
+    /// Contains information about the context of exchanging code for access token .
+    /// </summary>
+    public class OAuthExchangeCodeContext : PropertiesContext<OAuthOptions>
+    {
+        /// <summary>
+        /// Initializes a new <see cref="OAuthExchangeCodeContext"/>.
+        /// </summary>
+        /// <param name="properties">The <see cref="AuthenticationProperties"/>.</param>
+        /// <param name="context">The HTTP environment.</param>
+        /// <param name="scheme">The authentication scheme.</param>
+        /// <param name="options">The options used by the authentication middleware.</param>
+        /// <param name="tokenRequestParameters">The parameters that will be sent as query string for the token request</param>
+        public OAuthExchangeCodeContext(
+            AuthenticationProperties properties,
+            HttpContext context,
+            AuthenticationScheme scheme,
+            OAuthOptions options,
+            IDictionary<string, string> tokenRequestParameters)
+            : base(context, scheme, options, properties)
+        {
+            TokenRequestParameters = tokenRequestParameters;
+        }
+
+        /// <summary>
+        /// Gets the request parameters for the token request
+        /// </summary>
+        public IDictionary<string, string> TokenRequestParameters { get; }
+    }
+}
diff --git a/src/Security/Authentication/OAuth/src/OAuthHandler.cs b/src/Security/Authentication/OAuth/src/OAuthHandler.cs
index 0d2cf140663a..4655e008e201 100644
--- a/src/Security/Authentication/OAuth/src/OAuthHandler.cs
+++ b/src/Security/Authentication/OAuth/src/OAuthHandler.cs
@@ -99,7 +99,7 @@ protected override async Task<HandleRequestResult> HandleRemoteAuthenticateAsync
                 return HandleRequestResult.Fail("Code was not found.", properties);
             }
 
-            using (var tokens = await ExchangeCodeAsync(code, BuildRedirectUri(Options.CallbackPath)))
+            using (var tokens = await ExchangeCodeAsync(code, BuildRedirectUri(Options.CallbackPath), properties))
             {
                 if (tokens.Error != null)
                 {
@@ -159,7 +159,7 @@ protected override async Task<HandleRequestResult> HandleRemoteAuthenticateAsync
             }
         }
 
-        protected virtual async Task<OAuthTokenResponse> ExchangeCodeAsync(string code, string redirectUri)
+        protected virtual async Task<OAuthTokenResponse> ExchangeCodeAsync(string code, string redirectUri, AuthenticationProperties properties)
         {
             var tokenRequestParameters = new Dictionary<string, string>()
             {
@@ -170,6 +170,9 @@ protected virtual async Task<OAuthTokenResponse> ExchangeCodeAsync(string code,
                 { "grant_type", "authorization_code" },
             };
 
+            var exchangeCodeContext = new OAuthExchangeCodeContext(properties, Context, Scheme, Options, tokenRequestParameters);
+            await Events.OnExchangeCode(exchangeCodeContext);
+
             var requestContent = new FormUrlEncodedContent(tokenRequestParameters);
 
             var requestMessage = new HttpRequestMessage(HttpMethod.Post, Options.TokenEndpoint);