---
title: "Make Secure App-to-App Connections Using Cross App Access"
description: "Enterprise app-to-app integrations can create governance, security, and consent problems when API keys lack user context and standard OAuth leaves connection approval to individuals. The tutorial adds Cross App Access (XAA), an OAuth extension based on the Identity Assertion Authorization Grant, to a NestJS note-taking app and connects it to a to-do app through xaa.dev. It uses TypeScript, openid-client, and the testing site’s IdP, with two token exchanges: an ID token becomes an ID-JAG token, then a JWT-bearer grant exchanges that assertion at the resource authorization server for an access token. After authentication, the completed flow calls the to-do API and exposes each handshake step and response in console logs."
---

# Make Secure App-to-App Connections Using Cross App Access

[Okta](https://yomu.fyi/company/okta) · Alisa Duncan · Feb 10, 2026

**Type:** Tutorial

## Summary

Enterprise app-to-app integrations can create governance, security, and consent problems when API keys lack user context and standard OAuth leaves connection approval to individuals. The tutorial adds Cross App Access (XAA), an OAuth extension based on the Identity Assertion Authorization Grant, to a NestJS note-taking app and connects it to a to-do app through xaa.dev. It uses TypeScript, openid-client, and the testing site’s IdP, with two token exchanges: an ID token becomes an ID-JAG token, then a JWT-bearer grant exchanges that assertion at the resource authorization server for an access token. After authentication, the completed flow calls the to-do API and exposes each handshake step and response in console logs.

## Context

Enterprise integrations based on API keys or service accounts lack user context, while standard OAuth relies on individual consent that administrators cannot centrally see or control. These patterns create over-privilege, rotation, shadow IT, compliance, and security concerns.

## Approach / What changed

The tutorial implements Cross App Access in a NestJS and TypeScript note-taking app, using xaa.dev as an IdP-agnostic testing environment. The flow exchanges an ID token for an ID-JAG token through the IdP’s authorization server, then exchanges the ID-JAG assertion for a resource access token using the JWT-bearer grant.

## Takeaways

- Cross App Access uses the enterprise IdP as a central broker so administrators can manage and approve app-to-app connections.
- The token flow performs two exchanges: an ID token to an ID-JAG token, followed by an ID-JAG token to a to-do app access token.
- The completed demo calls the to-do API and logs authentication, token exchanges, and resource requests for inspection.

**Tags:** [Cross App Access](https://yomu.fyi/topic/cross-app-access), [NestJS](https://yomu.fyi/topic/nestjs), [OAuth 2.0](https://yomu.fyi/topic/oauth-2-0), [OpenID Connect](https://yomu.fyi/topic/openid-connect), [TypeScript](https://yomu.fyi/topic/typescript)

- Source: [Okta](https://developer.okta.com/blog/2026/02/10/xaa-client)
- Source URL: https://developer.okta.com/blog/2026/02/10/xaa-client
- Ingested by Yomu: 2026-09-09T08:43:17.900Z

[Read original post](https://developer.okta.com/blog/2026/02/10/xaa-client)