# Add Cross App Access to Your OIDC Resource Application

[Okta](https://yomu.fyi/company/okta) · Updating authorization server metadata · Aug 24, 2026

**Type:** Tutorial

## Summary

Cross App Access allows applications such as AI agents to access resource APIs on behalf of OpenID Connect federated users. The specification relies on an Identity Assertion Authorization Grant, which is a short-lived JSON Web Token issued by the customer Identity Provider. Resource authorization servers validate this token, resolve user identities using combined issuer and subject claims, and issue locally scoped access tokens without altering single sign-on flows. Implementations must bind issuers to registered connections before verifying signatures to prevent forgery attacks. In addition, servers should not issue refresh tokens, as clients instead resubmit the grant upon access token expiration.

## Context

Enterprise customers federated with OpenID Connect require a secure way for external applications and AI agents to access resource APIs on behalf of users without altering existing single sign-on integrations.

## Approach / What changed

Implement the Identity Assertion Authorization Grant flow by receiving the grant as a JWT bearer token, binding the unverified issuer to a known connection, validating the signature against that connection's JWKS, resolving the subject, and minting an access token without a refresh token.

## Takeaways

- User resolution must use both iss and sub together (plus the tenant claim for multi-tenant IdPs) rather than sub alone to prevent cross-tenant identity collisions.
- The resource authorization server must bind the unverified iss to a registered connection before verifying the signature against that connection's JWKS to prevent token forgery.
- Resource authorization servers should not issue refresh tokens with the access token, as the client resubmits the ID-JAG token directly when requesting a new access token.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [REST APIs](https://yomu.fyi/topic/rest-api)

[Read original post](https://developer.okta.com/blog/2026/08/24/xaa-oidc-resource)