# Add Cross App Access to Your OIDC Requesting Application

[Okta](https://yomu.fyi/company/okta) · Sohail Pathan · Aug 21, 2026

**Type:** Tutorial

## Summary

OpenID Connect federated applications connecting to third-party services can implement Cross App Access using the Identity Assertion Authorization Grant specification. When a user authenticates via the standard authorization code flow, the requesting application retains the issued refresh token. The application exchanges this refresh token at Okta's token endpoint via RFC 8693 token exchange to receive a short-lived Identity Assertion Authorization Grant JSON Web Token. Next, the application presents this assertion to the third-party resource authorization server using the RFC 7523 JWT bearer grant to obtain a final access token. Developers can configure an AI Agent and application integrations in Okta to validate the entire end-to-end request flow against test endpoints on xaa.dev.

## Context

Federated enterprise applications authenticated via OpenID Connect need a secure mechanism to access third-party resource application APIs without requiring users to sign in repeatedly.

## Approach / What changed

Implement Cross App Access by exchanging the user sign-in refresh token at the Okta identity provider token endpoint via RFC 8693 to obtain an Identity Assertion Authorization Grant JWT. Redeem that assertion token at the third-party resource application's authorization server using the RFC 7523 JWT bearer grant to acquire an access token for API requests, then test and verify the setup using Okta AI Agent configuration and xaa.dev.

## Takeaways

- The Identity Assertion Authorization Grant (ID-JAG) is a short-lived JWT issued by the IdP in exchange for the user's refresh token using RFC 8693 Token Exchange.
- To obtain an access token, the requesting app redeems the ID-JAG assertion at the resource server's token endpoint using the RFC 7523 JWT bearer grant type.
- Because ID-JAG tokens are short-lived, applications must request new ID-JAG tokens using the existing refresh token, re-authenticating the user only when the refresh token expires or gets revoked.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [REST APIs](https://yomu.fyi/topic/rest-api)

[Read original post](https://developer.okta.com/blog/2026/08/21/xaa-oidc-requesting)