# Okta Developer Secure, scalable, and highly available authentication and user management for any app. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Build an Authenticated Standalone Angular v22 App with the Okta Angular SDK DevFeed: [Build an Authenticated Standalone Angular v22 App with the Okta Angular SDK]() Original publisher: [Read original article]() Author: Alisa Duncan Published: 2026-08-25T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [Angular](), [Authentication](), [OpenID connect (OIDC)](), [Angular CLI](), [OAuth](), [SDKs](), [Node.js]() Tags: [angular](), [angular-v22](), [authentication](), [cli](), [node-js](), [oauth](), [oidc](), [release](), [sdk](), [tutorial]() ### AI overview This tutorial updates a small Angular v22 application to use the standalone Okta Angular SDK. It covers adding authentication with the provider function, protecting routes with functional guards, loading user groups with rxResource and signal inputs, and moving Okta configuration to runtime loading. ### Source excerpt Have you noticed that the Okta Angular SDK went fully standalone? There's no NgModule left to import, no importProvidersFrom wrapper to remember, and the guards are plain functions now. If you've been waiting for the SDK to look like the rest of your standalone Angular app, this is the release you were waiting for. In this post, we'll pick up a small Angular v22 project and finish it. We'll make the following changes: Add authentication using the new provideOktaAuth provider function Protect a route with the SDK's functional guard Load each user's groups with rxResource and a signal input Move the Okta configuration to runtime loading We're calling Okta's APIs directly for this project, so we don't have to stand up a separate backend. If you want to jump to the completed project, you can find it in the okta-angular-auth-signals-example GitHub repository. Otherwise, warm up your fingers and let's get coding! Note This post is best for developers familiar with Angular. If you are an Angular newbie, start by building your first Angular app using the tutorial created by the Angular team. Prerequisites For this tutorial, you will need the following tools: Node.js v22 or greater Angular CLI An Okta Integrator Free Plan account A web browser with good debugging capabilities Your favorite IDE Terminal window (if you aren't using an IDE with a built-in terminal) Table of Contents Get the starting Angular project Secure the Angular app with OAuth 2.1 and OpenID Connect (OIDC) using Okta Grant API scopes to read users and groups Allow cross-origin requests and protect the access token Add authentication with the standalone Okta Angular provider Protect routes with functional route guards Add users to your Okta org Display users and review Angular's rxResource API Load a user's groups with rxResource and a signal input Display group details using signal inputs Load your Okta configuration at runtime Learn more about Angular signals, standalone APIs, and OIDC Get the starting An ## Add Cross App Access to Your OIDC Resource Application DevFeed: [Add Cross App Access to Your OIDC Resource Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-24T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [API](), [Authorization](), [JSON Web Tokens](), [Single sign-on (SSO)](), [OAuth 2.0]() Tags: [api](), [authorization](), [cross-app-access](), [jwt](), [oauth-2-0](), [oidc](), [okta](), [scopes](), [sso](), [token](), [xaa]() ### AI overview This guide explains how OIDC-federated applications can support Cross App Access (XAA) for API access on behalf of users. It covers validating and redeeming the ID-JAG, resolving users from claims, issuing access tokens, updating authorization server metadata, and testing the end-to-end flow. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to allow applications to access your API on behalf of those users, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your authorization server already trusts the customer's IdP for single sign-on (SSO), and XAA reuses that same trust for API access. This guide details what you need to support, how to validate the grant, and how to resolve the user at your resource authorization server. Table of Contents How XAA in OIDC works Analyzing the ID-JAG claims XAA implementation checklist for OIDC-federated applications Mapping user identity from iss and sub Validating the ID-JAG and resolving the user Issuing the access token Updating authorization server metadata Making cross-application requests from your OIDC app securely Configure your XAA OIDC Resource app in Okta Create the OIDC requesting app for testing Create the OIDC resource app in Okta Register and configure the AI Agent in Okta Verify your Okta XAA setup on xaa.dev Configure OIDC SSO Verify the refresh token exchange for an ID-JAG token Redeem the ID-JAG for an access token at the resource authorization server Call the resource API with the access token Prove the XAA connection end-to-end Takeaways for implementors who also have SAML apps Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the customer's Identity Provider (IdP) for your authorization server. Your resource server accepts the token, identifies the user, and issues your own access token, all while leaving the customer's existing OIDC integration untouched. The sequence diagram shown below describes the OIDC XAA flow. Notice that the OIDC SSO flow stays the ## Add Cross App Access to Your OIDC Requesting Application DevFeed: [Add Cross App Access to Your OIDC Requesting Application]() Original publisher: [Read original article]() Author: Sohail Pathan Published: 2026-08-21T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OpenID connect (OIDC)](), [OAuth](), [OAuth 2.0](), [JSON Web Tokens](), [API](), [Authorization](), [AI Agent]() Tags: [agent](), [api](), [authorization](), [callback](), [claude](), [cross-app-access](), [identity](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [sso](), [third-party-applications](), [token](), [xaa]() ### AI overview This guide explains how an OIDC-federated application can use Cross App Access (XAA) to request resources from a third-party application. It describes exchanging a refresh token for an Identity Assertion Authorization Grant, exchanging that short-lived JWT for an OAuth access token, and using the access token for the resource API request. ### Source excerpt If you currently federate enterprise customers using OpenID Connect (OIDC) and want to connect with third-party applications, this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was designed with OIDC in mind. Your app already holds an ID token after sign-in, but it's the refresh token from that same sign-in that you exchange to reach a third-party app. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in OIDC works XAA implementation checklist for OIDC-federated applications Request the ID-JAG token Request the access token Call the resource API Handle token expiration Making cross-application requests from your OIDC app securely Configure your XAA OIDC requesting app in Okta Register the requesting app in Okta Register the test resource app in Okta Register your requesting app at xaa.dev Register and configure the AI Agent in Okta Validate the XAA connection end-to-end Learn more about Cross App Access, OIDC, and OAuth 2.0 How XAA in OIDC works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram below describes the OIDC XAA flow and how your application fits into it. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using the refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for OIDC-federated applications Follow the guide in this section to support XAA in your OIDC application when your app connects to a third-party resource application. The XAA flow places t ## I Found My Coordinates: Code, Community, and Okta DevFeed: [I Found My Coordinates: Code, Community, and Okta]() Original publisher: [Read original article]() Author: Vanshika Pandey Published: 2026-08-20T05:00:00Z Content type: opinion Language: en Sources: [Okta Developer]() Topics: [Development](), [Software Engineering](), [Google]() Tags: [advocacy](), [community](), [developer](), [google](), [hackathons](), [javascript](), [journey](), [networking](), [okta](), [security](), [work]() ### AI overview A personal account of developing a career through campus ambassador work, internships, community building, developer advocacy, and software development. ### Source excerpt It all started with a phone call from an institute that reached out to recruit me for its campus ambassador program. I was navigating my first year of college, figuring things out. It was all new for me, a new city, far from home, and a hostel room. I was not aware of anything except books and lectures. A senior at my campus ambassador program advised me to create a LinkedIn account and start looking for opportunities from day one. As they say, "You don't have to be great to start, but you have to start to be great." So I started applying for random internships. Soon, I received my first offer, where I discovered the power of networking and community. "No one can whistle a symphony. It takes a whole orchestra to play it." - H.E. Luccock Community has always been the best part of my life. The love and support we receive from each other are invaluable. I have always given to the community and gained far more in return. I attended an institution that wasn't particularly well-known. There weren't many communities, so why not do something about it? Through professional platforms, I discovered Google Developer Student Clubs (GDSC), researched the opportunity, and applied. I became the pioneer GDSC Lead at my institution, and one of 280 leads across India. We built the community from scratch, organizing meetups, workshops, and hackathons that delivered real value to students. These experiences sparked curiosity and helped students find their voice. When I stumbled across the Developer Advocate role, I was very happy and curious, so I started digging into it. My journey into advocacy "What you seek is seeking you." - Rumi One day, I got an email from a founder who said he liked my LinkedIn profile and wanted me to join his organization as a Developer Advocate - that moment was surreal. That's how I landed an internship as a Developer Advocate at Zuplo, where I learned something crucial: to understand developers' pain points, I needed to walk in their shoes. To truly advocat ## Build a Flask App with Okta for Secure OIDC Login and Authorized API Calls DevFeed: [Build a Flask App with Okta for Secure OIDC Login and Authorized API Calls]() Original publisher: [Read original article]() Author: Akanksha Bhasin Published: 2026-07-28T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [Flask](), [OpenID connect (OIDC)](), [Tutorial](), [API](), [Authentication](), [Authorization](), [OAuth 2.0](), [Python](), [web applications]() Tags: [api](), [authentication](), [authorization](), [flask](), [oauth](), [oauth-2-0](), [oidc](), [pkce](), [python](), [security](), [tutorial](), [web-app]() ### AI overview This tutorial explains how to build a Flask dashboard that uses Okta OpenID Connect for user sign-in and OAuth 2.0 access tokens to call a protected backend API. It also covers PKCE, custom scopes, self-service registration, and validating scopes to control API responses. ### Source excerpt Python syntax and the flexibility of the Flask microframework make it a popular choice for quickly building web applications. While Flask provides the essentials to get you started, you'll need to tackle two critical pieces yourself: secure user authentication and authorization for your backend services. After all, how do you securely sign users into your application? And once they're signed in, how does your app fetch data from a backend service that only serves authorized requests? This tutorial shows you how to solve both. You'll build a Flask dashboard app that signs users in with Okta using OpenID Connect (OIDC). Once signed in, the app uses the resulting OAuth 2.0 access token to call a separate backend API that responds only to authorized requests. In this common pattern, a web app needs to fetch data from a protected backend service. You'll use Authlib, an OIDC client library, to configure the Authorization Code flow with Proof Key for Code Exchange (PKCE) automatically. You'll also learn how to add a custom scope to the access token and validate it on the backend to control what data the API returns. Check out the complete source code on GitHub and get started without setting it up from scratch. Table of Contents Build a Flask app with OIDC authentication Create an app integration in the Okta Admin Console Enable self-service user registration Add secure user login to a Flask application with Okta Create a basic Flask web application Configure Flask environment variables Implement the OIDC authentication logic Run the Flask OAuth web app Call a protected API with OAuth scoped tokens Build a protected users API Extend the Flask app to interact with the resource server Update the Flask UI to display protected data Test the protected API integration Learn more about OAuth and OIDC Build a Flask app with OIDC authentication In this tutorial, you'll build a simple dashboard application and learn how to: Securely sign users in to view their profile information us ## Enable Your SAML Requesting App for Cross App Access DevFeed: [Enable Your SAML Requesting App for Cross App Access]() Original publisher: [Read original article]() Author: Alisa Duncan Published: 2026-07-17T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [OAuth 2.0](), [Authorization](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [API](), [AI Agent]() Tags: [api](), [authorization](), [claude](), [cross-app-access](), [digital-signature](), [identity](), [idp](), [implementation](), [jwt](), [oauth](), [oauth-2-0](), [oidc](), [openid-connect](), [payload](), [saml](), [signing](), [sso](), [xaa]() ### AI overview This guide explains how SAML-federated applications can use Cross App Access (XAA) to connect to third-party applications without migrating to OpenID Connect. It covers exchanging a SAML assertion for an OAuth refresh token, an ID-JAG, and an access token, along with token validation and Okta configuration. ### Source excerpt If you currently federate enterprise customers using Security Assertion Markup Language (SAML) and want to connect with third-party applications without migrating to OpenID Connect (OIDC), this Cross App Access (XAA) guide is for you. The Identity Assertion Authorization Grant specification, the basis of XAA, was originally designed with OIDC in mind. To use it in SAML applications, you must accommodate specific security and uniqueness requirements. This guide details what you need to support and how to make resource requests to a third-party app using XAA. Table of Contents How XAA in SAML works XAA implementation checklist for SAML-federated applications Request the refresh token Request the ID-JAG token Request the access token Handle token expiration Making cross-application requests from your SAML app securely Configure your XAA SAML Requesting App in Okta Register and configure the AI Agent in Okta Test the SAML 2.0 app Validate the XAA connection end-to-end Learn more about Cross App Access, SAML, and OAuth 2.0 How XAA in SAML works When an agent (like one running in Claude) needs API access, it presents an Identity Assertion Authorization Grant (ID-JAG). The ID-JAG is a short-lived JSON Web Token (JWT) issued by the Identity Provider (IdP) for your app's user. You exchange the ID-JAG token for an access token to the resource application you're connecting with. The sequence diagram shown below describes the SAML XAA flow and how your application fits in. You'll handle the flow in two parts: where your application requests the ID-JAG from the IdP using a refresh token, and where your app requests the access token from the ID-JAG from the third-party resource app's authorization server. XAA implementation checklist for SAML-federated applications Follow the guide in this section to support XAA in your SAML application when your app connects to a third-party resource application. The XAA flow places the burden of token validation onto the IdP and the resource ap ## Build a Secure C# MCP App with Cross App Access (XAA) DevFeed: [Build a Secure C# MCP App with Cross App Access (XAA)]() Original publisher: [Read original article]() Author: Aasawari Sahasrabuddhe Published: 2026-07-16T05:00:00Z Content type: tutorial Language: en Sources: [Okta Developer]() Topics: [cross-app-access](), [Model Context Protocol (MCP)](), [C#](), [SDKs](), [AI Agent](), [API]() Tags: [ai-agent](), [ai-agents](), [api](), [authorization](), [c-sharp](), [cross-app-access](), [csharp](), [jwt](), [mcp](), [oauth](), [oidc](), [pkce](), [sdk](), [xaa]() ### AI overview This tutorial explains how Cross App Access (XAA) extends user identity and enterprise policy to downstream applications, MCP servers, APIs, and agent tools. It demonstrates the XAA token-exchange flow and shows how to implement a secure MCP client in C# with an MCP SDK. ### Source excerpt A few years ago, getting a user signed in to an application or multiple applications with Single Sign-On (SSO) was enough; OpenID Connect (OIDC) handled the login, JWTs carried the claims, and Proof Key for Code Exchange (PKCE) made it secure. Today, with evolving AI, agents act on behalf of users and seek multiple accesses across different resources to execute a task. And that is when you'll hit the gap. The user has an identity, but the downstream service--like a Model Context Protocol (MCP) server, an API, or an agent tool has no way to trust it: the ID Token that proves the user's identity for your app, not for that service. You need a way to take that identity and have it trusted further down the chain, in line with the org's policy, without asking the user to log in again. Cross App Access (XAA) solves exactly that. The user authenticates once. The Identity Provider (IdP) evaluates the enterprise policy and issues a signed Identity Assertion. The downstream service exchanges that assertion for a scoped Bearer token. In this post, we'll explore how Cross App Access (XAA) closes the trust gap, test the flow using an XAA playground, and implement a secure MCP client in just a few lines of C# using our dedicated SDK. Table of Contents What is Cross App Access (XAA)? Implementing XAA with the C# MCP SDK Building the OIDC flow Automate XAA token exchange with C# SDK Connect the MCP client to the server Testing your C# MCP app with xaa.dev Run your C# MCP app with xaa.dev Learn More About Secure AI Agent Development with C# and MCP What is Cross App Access (XAA)? Before we start implementing and building the application, it is important to understand the mechanics of Cross App Access (XAA). At its core, XAA is an open standard that securely enables AI agents to act on behalf of a user and communicate with downstream applications without requiring constant, manual user consent. While the flow is sophisticated, it relies on two standard interactions: RFC 8693 (Token Exc ## Okta Launches Journeys, Curated Documentation Guides for Developer Projects DevFeed: [Okta Launches Journeys, Curated Documentation Guides for Developer Projects]() Original publisher: [Read original article]() Author: Dan Maharry Published: 2026-07-07T05:00:00Z Content type: release Language: en Sources: [Okta Developer]() Topics: [Documentation](), [Learning](), [SDKs]() Tags: [announce](), [apis](), [configuration](), [deployment](), [developers](), [docs](), [documentation](), [learning](), [migration](), [sdks]() ### AI overview Okta announces Journeys, curated end-to-end documentation guides for small-to-medium-sized development projects. Each Journey combines learning identity foundations, planning implementation decisions, and building identity solutions. ### Source excerpt Learning identity management is hard enough. Navigating Okta's documentation to build something shouldn't be. If you've ever lost an afternoon stitching together how-to guides, product docs, and scattered blog posts just to figure out where to start, you're not alone - and we've heard you, loudly and repeatedly. Today, we're excited to announce the official launch of Journeys: a new way to navigate Okta documentation built around the tasks you're actually trying to accomplish. What are Okta Journeys for developers? A Journey is a curated, expert-driven, end-to-end guide built around a small-to-medium-sized development project. Rather than sending you to find a single document and piece the rest together yourself, each Journey walks you through the entire project, from foundational concepts to completion. Journeys address the most frequent questions we've heard from developers. Every Journey includes both brand-new material and revised content to ensure that what you're reading is accurate, up to date, and genuinely useful. Each Journey organizes content into three main sections. Learn identity foundations Before you write a single line of code, it helps to know the terrain. The Learn section anchors the broad "identity" concept, covering foundational knowledge including Okta features, software development kits (SDKs), and application programming interfaces (APIs) relevant to your task. Whether you're new to Okta or just unfamiliar with a specific area, this section gives you the vocabulary and mental model you need to make informed decisions. It ensures you're not just following steps, but truly understanding the technology and concepts underlying your project. Plan your customer identity implementation Good implementations start with good planning. The Plan section walks you through the key decision points to consider before you begin - from the pros and cons of migration strategies and deployment models to configuration options, rate limits, and key performance in