Make Secure App-to-App Connections Using Cross App Access

Summary

Enterprise app-to-app integrations can create governance, security, and consent problems when API keys lack user context and standard OAuth leaves connection approval to individuals. The tutorial adds Cross App Access (XAA), an OAuth extension based on the Identity Assertion Authorization Grant, to a NestJS note-taking app and connects it to a to-do app through xaa.dev. It uses TypeScript, openid-client, and the testing site’s IdP, with two token exchanges: an ID token becomes an ID-JAG token, then a JWT-bearer grant exchanges that assertion at the resource authorization server for an access token. After authentication, the completed flow calls the to-do API and exposes each handshake step and response in console logs.

Takeaways

1. 1

   Cross App Access uses the enterprise IdP as a central broker so administrators can manage and approve app-to-app connections.

2. 2

   The token flow performs two exchanges: an ID token to an ID-JAG token, followed by an ID-JAG token to a to-do app access token.

3. 3

   The completed demo calls the to-do API and logs authentication, token exchanges, and resource requests for inspection.