Okta

Cross-App Access (XAA)

Cross-App Access is Okta's emerging OAuth profile for secure agent-to-app and app-to-app authorization, based on the IETF draft "OAuth Identity Assertion Authorization Grant" (ID-JAG, draft-ietf-oauth-identity-assertion-authz-grant). It lets an Identity Provider mint an identity assertion that downstream resource applications can exchange for a scoped access token, eliminating long-lived unmanaged credentials between AI agents and SaaS apps. Okta operates xaa.dev as a public sandbox for testing requesting and resource application implementations.

Documentation GitHub

Documentation

https://xaa.dev/

Other Resources

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-identity-assertion-authz-grant

https://xaa.dev/

https://developer.okta.com/blog/2026/01/20/introducing-xaadev-a-playground-for-cross-app-access

https://developer.okta.com/blog/2026/02/10/make-secure-app-to-app-connections-using-cross-app-access

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/apis.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-assign-admin-role-to-group-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-assign-admin-role-to-user-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-assign-group-to-application-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-and-activate-application-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-and-activate-authenticator-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-and-activate-group-rule-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-and-refresh-session-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-app-assign-user-and-activate-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-group-and-add-members-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-policy-with-rule-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-user-with-group-membership-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-deactivate-and-delete-user-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-enroll-and-activate-factor-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-find-user-and-assign-app-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-find-user-and-suspend-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-offboard-user-clear-sessions-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-onboard-user-to-group-and-app-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-provision-admin-user-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-reactivate-suspended-user-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-reset-and-reenroll-factor-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-update-group-rule-expression-workflow.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/okta-cross-app-access"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

API entry from apis.yml

aid: okta:okta-cross-app-access
name: Cross-App Access (XAA)
description: Cross-App Access is Okta's emerging OAuth profile for secure agent-to-app and app-to-app
  authorization, based on the IETF draft "OAuth Identity Assertion Authorization Grant" (ID-JAG, draft-ietf-oauth-identity-assertion-authz-grant).
  It lets an Identity Provider mint an identity assertion that downstream resource applications can exchange
  for a scoped access token, eliminating long-lived unmanaged credentials between AI agents and SaaS apps.
  Okta operates xaa.dev as a public sandbox for testing requesting and resource application implementations.
humanURL: https://xaa.dev/
baseURL: https://xaa.dev
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
tags:
- Cross-App Access
- AI Agents
- Authentication
- ID-JAG
- Authorization
tags_raw:
- Cross-App Access
- AI Agents
- OAuth
- ID-JAG
- Authorization
properties:
- type: Documentation
  url: https://xaa.dev/
- type: Specification
  url: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-identity-assertion-authz-grant
- type: Sandbox
  url: https://xaa.dev/
- type: Blog
  url: https://developer.okta.com/blog/2026/01/20/introducing-xaadev-a-playground-for-cross-app-access
- type: Blog
  url: https://developer.okta.com/blog/2026/02/10/make-secure-app-to-app-connections-using-cross-app-access