---
title: "Build Secure Agent-to-App Connections with Cross App Access (XAA) Using OIDC"
description: "The guide presents Cross App Access (XAA) as a protocol for secure agent-to-app and app-to-app access, giving enterprise IT centralized control over connections, policies, and accessed resources. It walks through an OIDC demonstration using Todo0 as the Resource App, Agent0 as the Requesting App, and Okta as the enterprise identity provider, covering app registration, trust establishment, token exchange, and API calls. The flow uses the OAuth 2.0 Identity Assertion Authorization Grant: Bob logs in once, Agent0 obtains an identity assertion, Okta exchanges it for a Todo0 access token, and Agent0 calls the protected API. The demonstrated result is an agent that can read pending tasks, add tasks, and mark tasks complete, with changes reflected in Todo0. The guide is marked out of date because its Admin Console instructions have been replaced by AI agent registration under Directory > AI Agents."
---

# Build Secure Agent-to-App Connections with Cross App Access (XAA) Using OIDC

[Okta](https://yomu.fyi/company/okta) · Sohail Pathan · Sep 3, 2025

**Type:** Tutorial

## Summary

The guide presents Cross App Access (XAA) as a protocol for secure agent-to-app and app-to-app access, giving enterprise IT centralized control over connections, policies, and accessed resources. It walks through an OIDC demonstration using Todo0 as the Resource App, Agent0 as the Requesting App, and Okta as the enterprise identity provider, covering app registration, trust establishment, token exchange, and API calls. The flow uses the OAuth 2.0 Identity Assertion Authorization Grant: Bob logs in once, Agent0 obtains an identity assertion, Okta exchanges it for a Todo0 access token, and Agent0 calls the protected API. The demonstrated result is an agent that can read pending tasks, add tasks, and mark tasks complete, with changes reflected in Todo0. The guide is marked out of date because its Admin Console instructions have been replaced by AI agent registration under Directory > AI Agents.

## Context

The post identifies a gap in OAuth 2.0: consent screens centered on individual users do not give enterprises effective control over communication between independent applications. It says the rise of AI agents increases the need to regulate sensitive cross-system data flows, enforce security policies, and provide visibility into access.

## Approach / What changed

The walkthrough configures Todo0 as a resource app, Agent0 as a requesting app, and Okta as the identity provider. It establishes trust, configures OAuth 2.0 and OIDC values, runs local Node.js applications, and demonstrates the OAuth 2.0 Identity Assertion Authorization Grant, in which Agent0 exchanges an identity assertion for a Todo0 access token.

## Takeaways

- XAA is described as providing centralized enterprise control over which applications connect, the security policies they follow, and the resources they access.
- The demonstrated token flow has Bob authenticate with Okta once; Agent0 receives an identity assertion, obtains a Todo0 access token, and uses it for protected API calls.
- The original XAA Resource App, XAA Requesting App, and Manage Connections Admin Console steps are obsolete and have been replaced by AI agent registration under Directory > AI Agents.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [OAuth 2.0](https://yomu.fyi/topic/oauth-2-0), [OIDC](https://yomu.fyi/topic/oidc)

- Source: [Okta](https://developer.okta.com/blog/2025/09/03/cross-app-access)
- Source URL: https://developer.okta.com/blog/2025/09/03/cross-app-access
- Ingested by Yomu: 2026-09-09T08:43:42.411Z

[Read original post](https://developer.okta.com/blog/2025/09/03/cross-app-access)