# Enable Your SAML Requesting App for Cross App Access

[Okta](https://yomu.fyi/company/okta) · Alisa Duncan · Jul 17, 2026

**Type:** Tutorial

## Summary

Cross App Access allows enterprise applications federated with Security Assertion Markup Language to interact with third-party resource APIs without migrating to OpenID Connect. The flow adapts the Identity Assertion Authorization Grant specification to SAML by adding three token exchange steps following the standard single sign-on handshake. First, the application exchanges the validated SAML assertion for an OAuth refresh token using Okta's token endpoint and a private key JSON Web Token. The application then uses the refresh token to request a short-lived Identity Assertion Authorization Grant token from Okta. Finally, the application presents the Identity Assertion Authorization Grant token to the third-party authorization server to obtain an OAuth access token.

## Context

Enterprise applications federating users via SAML need to grant agents or services access to third-party APIs without executing a full migration to OpenID Connect.

## Approach / What changed

Implement Cross App Access by chaining token exchanges: exchange the initial SAML assertion for an OAuth refresh token via RFC 8693, exchange that refresh token for a short-lived ID-JAG token, and redeem the ID-JAG token at the resource authorization server for an API access token via RFC 7523.

## Takeaways

- The SAML assertion extracted during the ACS request must be Base64-encoded and exchanged immediately for a refresh token, and must never be persisted past this initial exchange.
- Both the refresh token exchange and the ID-JAG token exchange require a sensitive client assertion formatted as a private key JWT signed with an asymmetric key pair.
- If the ID-JAG token expires, a new one is requested using the refresh token, but if the refresh token expires with an invalid\_grant error, the user must re-authenticate via SAML SSO.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Authentication](https://yomu.fyi/topic/authentication), [REST APIs](https://yomu.fyi/topic/rest-api)

[Read original post](https://developer.okta.com/blog/2026/07/17/xaa-saml-requester)