Add Cross App Access to Your OIDC Resource Application

Summary

Cross App Access allows applications such as AI agents to access resource APIs on behalf of OpenID Connect federated users. The specification relies on an Identity Assertion Authorization Grant, which is a short-lived JSON Web Token issued by the customer Identity Provider. Resource authorization servers validate this token, resolve user identities using combined issuer and subject claims, and issue locally scoped access tokens without altering single sign-on flows. Implementations must bind issuers to registered connections before verifying signatures to prevent forgery attacks. In addition, servers should not issue refresh tokens, as clients instead resubmit the grant upon access token expiration.

Context

Enterprise customers federated with OpenID Connect require a secure way for external applications and AI agents to access resource APIs on behalf of users without altering existing single sign-on integrations.

Approach / What changed

Implement the Identity Assertion Authorization Grant flow by receiving the grant as a JWT bearer token, binding the unverified issuer to a known connection, validating the signature against that connection's JWKS, resolving the subject, and minting an access token without a refresh token.

Takeaways

• User resolution must use both iss and sub together (plus the tenant claim for multi-tenant IdPs) rather than sub alone to prevent cross-tenant identity collisions.
• The resource authorization server must bind the unverified iss to a registered connection before verifying the signature against that connection's JWKS to prevent token forgery.
• Resource authorization servers should not issue refresh tokens with the access token, as the client resubmits the ID-JAG token directly when requesting a new access token.

Related reading

• Okta · Aug 21, 2026

  Add Cross App Access to Your OIDC Requesting Application

  OpenID Connect federated applications connecting to third-party services can implement Cross App Access using the Identity Assertion Authorization Grant specification. When a user authenticates via the standard authorization code flow, the requesting application retains the issued refresh token. The application exchanges this refresh token at Okta's token endpoint via RFC 8693 token exchange to receive a short-lived Identity Assertion Authorization Grant JSON Web Token. Next, the application presents this assertion to the third-party resource authorization server using the RFC 7523 JWT bearer grant to obtain a final access token. Developers can configure an AI Agent and application integrations in Okta to validate the entire end-to-end request flow against test endpoints on xaa.dev.

  Sohail Pathan

• Okta · Jul 17, 2026

  Enable Your SAML Requesting App for Cross App Access