# Enable Your SAML Requesting App for Cross App Access

DevFeed: [Enable Your SAML Requesting App for Cross App Access](<https://devfeed.tech/articles/enable-your-saml-requesting-app-for-cross-app-access-15972.md>)

Original publisher: [Read original article](<https://developer.okta.com/blog/2026/07/17/xaa-saml-requester>)

Author: Alisa Duncan

Published: 2026-07-17T05:00:00Z

Content type: tutorial

Language: en

Sources: [Okta Developer](<https://devfeed.tech/sources/okta-developer.md>)

Topics: [OAuth 2.0](<https://devfeed.tech/topics/oauth2.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [API](<https://devfeed.tech/topics/api.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [claude](<https://devfeed.tech/tags/claude.md>), [cross-app-access](<https://devfeed.tech/tags/cross-app-access.md>), [digital-signature](<https://devfeed.tech/tags/digital-signature.md>), [identity](<https://devfeed.tech/tags/identity.md>), [idp](<https://devfeed.tech/tags/idp.md>), [implementation](<https://devfeed.tech/tags/implementation.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oauth-2-0](<https://devfeed.tech/tags/oauth-2-0.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [payload](<https://devfeed.tech/tags/payload.md>), [saml](<https://devfeed.tech/tags/saml.md>), [signing](<https://devfeed.tech/tags/signing.md>), [sso](<https://devfeed.tech/tags/sso.md>), [xaa](<https://devfeed.tech/tags/xaa.md>)

## AI overview

This guide explains how SAML-federated applications can use Cross App Access (XAA) to connect to third-party applications without migrating to OpenID Connect. It covers exchanging a SAML assertion for an OAuth refresh token, an ID-JAG, and an access token, along with token validation and Okta configuration.

## Source excerpt

If you currently federate enterprise customers using Security Assertion Markup Language (SAML) and want to connect with third-party applications without migrating to OpenID Connect (OIDC), this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was originally designed with OIDC in mind. To use it in SAML applications, you must accommodate specific security and uniqueness requirements. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in SAML works XAA implementation checklist for SAML-federated applications Request the refresh token Request the ID-JAG token Request the access token Handle token expiration Making cross-application requests from your SAML app securely Configure your XAA SAML Requesting App in Okta Register and configure the AI Agent in Okta Test the SAML 2.0 app Validate the XAA connection end-to-end Learn more about Cross App Access, SAML, and OAuth 2.0 How XAA in SAML works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram shown below describes the SAML XAA flow and how your application fits in. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using a refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for SAML-federated applications Follow the guide in this section to support XAA in your SAML application when your app connects to a third-party resource application. The XAA flow places the burden of token validation onto the IdP and the resource ap