Add Cross App Access to Your OIDC Requesting Application

Summary

OpenID Connect federated applications connecting to third-party services can implement Cross App Access using the Identity Assertion Authorization Grant specification. When a user authenticates via the standard authorization code flow, the requesting application retains the issued refresh token. The application exchanges this refresh token at Okta's token endpoint via RFC 8693 token exchange to receive a short-lived Identity Assertion Authorization Grant JSON Web Token. Next, the application presents this assertion to the third-party resource authorization server using the RFC 7523 JWT bearer grant to obtain a final access token. Developers can configure an AI Agent and application integrations in Okta to validate the entire end-to-end request flow against test endpoints on xaa.dev.

Context

Federated enterprise applications authenticated via OpenID Connect need a secure mechanism to access third-party resource application APIs without requiring users to sign in repeatedly.

Approach / What changed

Implement Cross App Access by exchanging the user sign-in refresh token at the Okta identity provider token endpoint via RFC 8693 to obtain an Identity Assertion Authorization Grant JWT. Redeem that assertion token at the third-party resource application's authorization server using the RFC 7523 JWT bearer grant to acquire an access token for API requests, then test and verify the setup using Okta AI Agent configuration and xaa.dev.

Takeaways

• The Identity Assertion Authorization Grant (ID-JAG) is a short-lived JWT issued by the IdP in exchange for the user's refresh token using RFC 8693 Token Exchange.
• To obtain an access token, the requesting app redeems the ID-JAG assertion at the resource server's token endpoint using the RFC 7523 JWT bearer grant type.
• Because ID-JAG tokens are short-lived, applications must request new ID-JAG tokens using the existing refresh token, re-authenticating the user only when the refresh token expires or gets revoked.

Related reading

• Okta · Aug 24, 2026

  Add Cross App Access to Your OIDC Resource Application

  Cross App Access allows applications such as AI agents to access resource APIs on behalf of OpenID Connect federated users. The specification relies on an Identity Assertion Authorization Grant, which is a short-lived JSON Web Token issued by the customer Identity Provider. Resource authorization servers validate this token, resolve user identities using combined issuer and subject claims, and issue locally scoped access tokens without altering single sign-on flows. Implementations must bind issuers to registered connections before verifying signatures to prevent forgery attacks. In addition, servers should not issue refresh tokens, as clients instead resubmit the grant upon access token expiration.

  Updating authorization server metadata

• Okta · Jul 17, 2026

  Enable Your SAML Requesting App for Cross App Access

  Cross App Access allows enterprise applications federated with Security Assertion Markup Language to interact with third-party resource APIs without migrating to OpenID Connect. The flow adapts the Identity Assertion Authorization Grant specification to SAML by adding three token exchange steps following the standard single sign-on handshake. First, the application exchanges the validated SAML assertion for an OAuth refresh token using Okta's token endpoint and a private key JSON Web Token. The application then uses the refresh token to request a short-lived Identity Assertion Authorization Grant token from Okta. Finally, the application presents the Identity Assertion Authorization Grant token to the third-party authorization server to obtain an OAuth access token.