# Add Cross App Access to Your OIDC Requesting Application

DevFeed: [Add Cross App Access to Your OIDC Requesting Application](<https://devfeed.tech/articles/add-cross-app-access-to-your-oidc-requesting-application-15975.md>)

Original publisher: [Read original article](<https://developer.okta.com/blog/2026/08/21/xaa-oidc-requesting>)

Author: Sohail Pathan

Published: 2026-08-21T05:00:00Z

Content type: tutorial

Language: en

Sources: [Okta Developer](<https://devfeed.tech/sources/okta-developer.md>)

Topics: [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [API](<https://devfeed.tech/topics/api.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [api](<https://devfeed.tech/tags/api.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [callback](<https://devfeed.tech/tags/callback.md>), [claude](<https://devfeed.tech/tags/claude.md>), [cross-app-access](<https://devfeed.tech/tags/cross-app-access.md>), [identity](<https://devfeed.tech/tags/identity.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [sso](<https://devfeed.tech/tags/sso.md>), [third-party-applications](<https://devfeed.tech/tags/third-party-applications.md>), [token](<https://devfeed.tech/tags/token.md>), [xaa](<https://devfeed.tech/tags/xaa.md>)

## AI overview

This guide explains how an OIDC-federated application can use Cross App Access (XAA) to request resources from a third-party application. It describes exchanging a refresh token for an Identity Assertion Authorization Grant, exchanging that short-lived JWT for an OAuth access token, and using the access token for the resource API request.

## Source excerpt

If you currently federate enterprise customers using OpenID Connect (OIDC) and want to connect with third-party applications, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your app already holds an ID token after sign-in, but it's the refresh token from that same sign-in that you exchange to reach a third-party app. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in OIDC works XAA implementation checklist for OIDC-federated applications Request the ID-JAG token Request the access token Call the resource API Handle token expiration Making cross-application requests from your OIDC app securely Configure your XAA OIDC requesting app in Okta Register the requesting app in Okta Register the test resource app in Okta Register your requesting app at xaa.dev Register and configure the AI Agent in Okta Validate the XAA connection end-to-end Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram below describes the OIDC XAA flow and how your application fits into it. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using the refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for OIDC-federated applications Follow the guide in this section to support XAA in your OIDC application when your app connects to a third-party resource application. The XAA flow places t