Okta

Cross-App Access (XAA)

Cross-App Access is Okta's emerging OAuth profile for secure agent-to-app and app-to-app authorization, based on the IETF draft "OAuth Identity Assertion Authorization Grant" (ID-JAG, draft-ietf-oauth-identity-assertion-authz-grant). It lets an Identity Provider mint an identity assertion that downstream resource applications can exchange for a scoped access token, eliminating long-lived unmanaged credentials between AI agents and SaaS apps. Okta operates xaa.dev as a public sandbox for testing requesting and resource application implementations.

Documentation GitHub

Documentation

https://xaa.dev/

Other Resources

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-identity-assertion-authz-grant

https://xaa.dev/

https://developer.okta.com/blog/2026/01/20/introducing-xaadev-a-playground-for-cross-app-access

https://developer.okta.com/blog/2026/02/10/make-secure-app-to-app-connections-using-cross-app-access

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/apis.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-assign-admin-role-to-group-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-assign-admin-role-to-user-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-assign-group-to-application-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-and-activate-application-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-and-activate-authenticator-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-and-activate-group-rule-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-and-refresh-session-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-app-assign-user-and-activate-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-group-and-add-members-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-policy-with-rule-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-create-user-with-group-membership-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-deactivate-and-delete-user-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-enroll-and-activate-factor-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-find-user-and-assign-app-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-find-user-and-suspend-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-offboard-user-clear-sessions-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-onboard-user-to-group-and-app-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-provision-admin-user-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-reactivate-suspended-user-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-reset-and-reenroll-factor-workflow.yml

https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/arazzo/okta-update-group-rule-expression-workflow.yml

API entry from apis.yml

aid: okta:okta-cross-app-access
name: Cross-App Access (XAA)
description: Cross-App Access is Okta's emerging OAuth profile for secure agent-to-app and app-to-app
  authorization, based on the IETF draft "OAuth Identity Assertion Authorization Grant" (ID-JAG, draft-ietf-oauth-identity-assertion-authz-grant).
  It lets an Identity Provider mint an identity assertion that downstream resource applications can exchange
  for a scoped access token, eliminating long-lived unmanaged credentials between AI agents and SaaS apps.
  Okta operates xaa.dev as a public sandbox for testing requesting and resource application implementations.
humanURL: https://xaa.dev/
baseURL: https://xaa.dev
image: https://kinlane-images.s3.amazonaws.com/shared/apis-json/apis-json-logo.jpg
tags:
- Cross-App Access
- AI Agents
- OAuth
- ID-JAG
- Authorization
properties:
- type: Documentation
  url: https://xaa.dev/
- type: Specification
  url: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-identity-assertion-authz-grant
- type: Sandbox
  url: https://xaa.dev/
- type: Blog
  url: https://developer.okta.com/blog/2026/01/20/introducing-xaadev-a-playground-for-cross-app-access
- type: Blog
  url: https://developer.okta.com/blog/2026/02/10/make-secure-app-to-app-connections-using-cross-app-access