Beginning in October, Okta release version notations are changing from year.month to year.week. For example, 2026.10.0 will become 2026.41.0, where 41 indicates that week of the year that the deployment occurs. More information is available in this knowledge base article.

    On this page

    Enable Cross App Access (XAA): Build a requesting app

    Let your app access another app's APIs on behalf of a signed-in user. No separate authentication prompts and no static secrets.

    Introduction

    Cross App Access (XAA) lets your app call another app's API on behalf of a user who is already signed in through Okta, without static API keys or a second sign-in prompt. As a requesting app, your app signs the user in through SSO (OIDC or SAML), exchanges that sign-in for an ID-JAG from Okta, and redeems the ID-JAG at the resource app's authorization server for a scoped access token. In Okta, a requesting app is registered as an AI agent.

    Notes:

    • This journey assumes that your app already has OIDC or SAML SSO setup. You're adding the XAA token exchange on top.
    • Starting from scratch? Set up SSO first.
    • This journey covers apps with a human user in the loop. It doesn't cover autonomous AI agents or background jobs.

    This journey covers the requesting app role. If you're building an API that accepts incoming XAA calls, see Enable Cross App Access (XAA): Build a resource app.

    What you accomplish

    By the end of this journey you can accomplish the following:

    • Your app can sign a user in and complete the full XAA token exchange, from authentication through ID-JAG to a scoped resource access token.
    • You can review the end-to-end token exchange flow in the Okta System Logs or with any enterprise logging tool that can capture the same events.
    • You have a tested the end-to-end XAA flow that passes the xaa.dev conformance tests.
    • Your integration is ready to submit to the OIN catalog through the OIN Wizard with the xaa.dev conformance log as test evidence.

    Learn

    New to Okta? Understand these concepts:

    • Okta org: Serves as your central Okta development hub, encapsulating all configurations, users, groups, policies, and other objects that your app uses.
    • Identity and Access Management (IAM) overview: Learn the key issues and concepts for adding identity and access management to your internal and external services.

    Understand these before you build:

    • Cross App Access overview: how XAA works and how it layers over OIDC or SAML.
    • ID-JAG token: The assertion Okta issues when you exchange your sign-in token (an ID token or a refresh token). You redeem it at the resource app's authorization server for an access token.

    Plan

    Before you write any code, ensure that you have the following:

    • Existing SSO integration: XAA is added on top of an existing SSO app integration (OIDC or SAML). If you haven't set up SSO yet, configure a functional SSO integration (opens new window) first.
    • Understand your requesting app architecture: In Okta, your requesting app uses an SSO integration (OIDC or SAML) for user sign-in and an AI agent to sign token exchange requests. Link the AI agent to your SSO app in the Admin Console.
    • Check your IdP/CIAM provider: Verify WorkOS, Auth0, or custom CIAM solutions support RFC 8693 token exchange. For homegrown CIAM, plan the necessary changes to support the token exchange flow.
    • Design your scope handling: Scopes are defined by the resource app. Decide which scopes your app requests, and make sure that the resource connection on your AI agent allows them.
    • Test environment: Use xaa.dev (opens new window) as the test tool. It acts as the resource app and authorization server for your tests, and its conformance log serves as the test evidence for OIN submission.
    • Okta org: An Okta Integrator Free Plan (opens new window) org and a user with the appropriate admin permissions to manage your org, apps, and AI agents. See Learn about administrators (opens new window) in the product documentation.

    Note: The audience (the resource app's authorization server issuer URL) and the resource identifier that are configured in your IdP must exactly match the values your resource app expects. Even minor differences, such as a trailing slash or a scheme mismatch, commonly cause token validation failures.

    Build

    Your SSO integration is already set up. These steps add XAA on top:

    1. Register your requesting app as an AI agent: In the Admin Console, register an AI agent, link it to your SSO app, set its client registration method, and add a resource connection (opens new window) to the resource app.
    2. Implement token exchange: Authenticate the user through SSO, exchange their session for an ID-JAG at Okta's authorization server, and redeem it at the resource app's authorization server for an access token. OIDC apps exchange an ID or refresh token, while SAML apps swap their assertion for a refresh token first. See the OIDC token exchange guide and the SAML token exchange guide.
    3. Make the API call: Include the resource access token in the Authorization header: Authorization: Bearer {resource-access-token}
    4. Handle token expiration: When the access token expires, request a new ID-JAG from your ID token or refresh token and redeem it again. If Okta returns invalid_grant, the user must sign in again. Don't request a refresh token from the resource app.
    5. Get the resource app's details: Find the resource app's authorization server issuer URL and resource identifier in its metadata or docs. Use these as the audience and resource values during token exchange. See Expose XAA metadata for your resource app.

    Validate

    Test your flow end to end on xaa.dev (opens new window), which acts as the resource app and its authorization server. Run the tests for your protocol until conformance passed appears, then export the JSON conformance log.

    For OIN submission, follow the xaa.dev testing steps in the OIN submission guide. If an exchange fails, see the Troubleshoot section of the token exchange guide.

    Note: For further guidance and examples, see the following blogs:

    Go further

    Congratulations, your requesting app is now XAA-enabled. Here's how to expand your integration and reach enterprise customers:

    Edit This Page On GitHub