---
title: "How to Build and List Secure Cross App Access (XAA) Connections on Okta Integration Network (OIN)"
description: "Cross App Access (XAA) provides an identity framework for securing token-based communication when software or AI agents access external ecosystems through trusted identity providers. It replaces long-lived API keys and hardcoded secrets with real-time identity propagation, while allowing enterprises to control connected apps, requested scopes, and user access. The guide explains prerequisites for requesting and resource apps, including OIDC or SAML SSO, authorization-server support, protected resources, scopes, an Okta Integrator Free Plan org, and tested workflows. It then describes token exchange testing: requesting apps obtain an ID token and mint an ID-JAG, while resource apps validate the ID-JAG and issue a scoped access token. To seek OIN listing and XAA enablement, applicants submit SSO integration details, metadata, testing evidence, and a questionnaire to Okta."
---

# How to Build and List Secure Cross App Access (XAA) Connections on Okta Integration Network (OIN)

[Okta](https://yomu.fyi/company/okta) · Gagan Sikri · Jul 6, 2026

**Type:** Tutorial

## Summary

Cross App Access (XAA) provides an identity framework for securing token-based communication when software or AI agents access external ecosystems through trusted identity providers. It replaces long-lived API keys and hardcoded secrets with real-time identity propagation, while allowing enterprises to control connected apps, requested scopes, and user access. The guide explains prerequisites for requesting and resource apps, including OIDC or SAML SSO, authorization-server support, protected resources, scopes, an Okta Integrator Free Plan org, and tested workflows. It then describes token exchange testing: requesting apps obtain an ID token and mint an ID-JAG, while resource apps validate the ID-JAG and issue a scoped access token. To seek OIN listing and XAA enablement, applicants submit SSO integration details, metadata, testing evidence, and a questionnaire to Okta.

## Context

Software and AI agents increasingly read data, execute actions, and call APIs across enterprise systems. The guide presents XAA as a way to address the security and governance problems created by static API keys, scattered OAuth consent, and unmanaged integrations, while giving enterprises visibility and audit trails for cross-app identity flows.

## Approach / What changed

The guide separates requesting-app and resource-app responsibilities, provides OIDC- and SAML-specific implementation paths, and requires successful token-exchange testing with Okta as the identity provider. It then outlines OIN listing and XAA enablement, including the metadata questionnaire, evidence requirements, and submission process.

## Takeaways

- A requesting app receives an ID token or SAML assertion from the identity provider and exchanges it for an Identity Assertion Authorization Grant (ID-JAG), while a resource app validates the ID-JAG and issues a scoped access token.
- XAA support requires an existing OIDC or SAML SSO integration, defined app roles, appropriate authorization-server and scope configuration for resource apps, an Okta Integrator Free Plan org, and tested workflows.
- XAA enablement requires an OIN SSO listing or submission plus a manual request to Okta; requesting apps provide exchange details, while resource apps attach evidence of ID-JAG validation and scoped-token exchange.

**Tags:** [AI Agents](https://yomu.fyi/topic/ai-agents), [OAuth 2.0](https://yomu.fyi/topic/oauth-2-0), [OIDC](https://yomu.fyi/topic/oidc), [SAML](https://yomu.fyi/topic/saml), [Security](https://yomu.fyi/topic/security)

- Source: [Okta](https://developer.okta.com/blog/2026/07/06/submit-oin-xaa)
- Source URL: https://developer.okta.com/blog/2026/07/06/submit-oin-xaa
- Ingested by Yomu: 2026-09-09T08:42:57.600Z

[Read original post](https://developer.okta.com/blog/2026/07/06/submit-oin-xaa)