How to Build and List Secure Cross App Access (XAA) Connections on Okta Integration Network (OIN)

Summary

Cross App Access (XAA) provides an identity framework for securing token-based communication when software or AI agents access external ecosystems through trusted identity providers. It replaces long-lived API keys and hardcoded secrets with real-time identity propagation, while allowing enterprises to control connected apps, requested scopes, and user access. The guide explains prerequisites for requesting and resource apps, including OIDC or SAML SSO, authorization-server support, protected resources, scopes, an Okta Integrator Free Plan org, and tested workflows. It then describes token exchange testing: requesting apps obtain an ID token and mint an ID-JAG, while resource apps validate the ID-JAG and issue a scoped access token. To seek OIN listing and XAA enablement, applicants submit SSO integration details, metadata, testing evidence, and a questionnaire to Okta.

Takeaways

1. 1

   A requesting app receives an ID token or SAML assertion from the identity provider and exchanges it for an Identity Assertion Authorization Grant (ID-JAG), while a resource app validates the ID-JAG and issues a scoped access token.

2. 2

   XAA support requires an existing OIDC or SAML SSO integration, defined app roles, appropriate authorization-server and scope configuration for resource apps, an Okta Integrator Free Plan org, and tested workflows.

3. 3

   XAA enablement requires an OIN SSO listing or submission plus a manual request to Okta; requesting apps provide exchange details, while resource apps attach evidence of ID-JAG validation and scoped-token exchange.