Build Secure Agent-to-App Connections with Cross App Access (XAA) Using OIDC

Summary

The guide presents Cross App Access (XAA) as a protocol for secure agent-to-app and app-to-app access, giving enterprise IT centralized control over connections, policies, and accessed resources. It walks through an OIDC demonstration using Todo0 as the Resource App, Agent0 as the Requesting App, and Okta as the enterprise identity provider, covering app registration, trust establishment, token exchange, and API calls. The flow uses the OAuth 2.0 Identity Assertion Authorization Grant: Bob logs in once, Agent0 obtains an identity assertion, Okta exchanges it for a Todo0 access token, and Agent0 calls the protected API. The demonstrated result is an agent that can read pending tasks, add tasks, and mark tasks complete, with changes reflected in Todo0. The guide is marked out of date because its Admin Console instructions have been replaced by AI agent registration under Directory > AI Agents.

Takeaways

1. 1

   XAA is described as providing centralized enterprise control over which applications connect, the security policies they follow, and the resources they access.

2. 2

   The demonstrated token flow has Bob authenticate with Okta once; Agent0 receives an identity assertion, obtains a Todo0 access token, and uses it for protected API calls.

3. 3

   The original XAA Resource App, XAA Requesting App, and Manage Connections Admin Console steps are obsolete and have been replaced by AI agent registration under Directory > AI Agents.