Okta · Example Payload

Okta Cross App Access Grant Example

IdentityWorkforce IdentityCustomer IdentityAuthenticationAuthorizationSingle Sign-OnMulti-Factor AuthenticationIdentity GovernancePrivileged AccessAI AgentsCross-App AccessMCPPlatform

Okta Cross App Access Grant Example is an example object payload from Okta, with 3 top-level fields. It illustrates the shape of data this provider's APIs accept or return.

Top-level fields

$commentexchangeassertion_claims

Example Payload

{
  "$comment": "Illustrative Cross-App Access (XAA) token exchange following the IETF draft 'OAuth Identity Assertion Authorization Grant' (ID-JAG). Subject token is issued by the IdP (Okta), exchanged at the resource app's authorization server for a scoped access token.",
  "exchange": {
    "endpoint": "https://resource-app.example.com/oauth2/token",
    "request": {
      "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
      "subject_token": "<id_jag.assertion.jwt>",
      "subject_token_type": "urn:ietf:params:oauth:token-type:id_jag",
      "audience": "https://resource-app.example.com/",
      "scope": "documents.read"
    },
    "response": {
      "access_token": "ya29.scoped.example.access.token",
      "issued_token_type": "urn:ietf:params:oauth:token-type:access_token",
      "token_type": "Bearer",
      "expires_in": 600,
      "scope": "documents.read"
    }
  },
  "assertion_claims": {
    "iss": "https://example.okta.com",
    "sub": "00u1a2b3c4D5E6F7G8H9",
    "aud": "https://resource-app.example.com/",
    "client_id": "0oaRequestingAgentAppId",
    "agent_id": "agent-7af12",
    "agent_owner": "amina.okafor@example.com",
    "scope": "documents.read",
    "iat": 1748563200,
    "exp": 1748566800
  }
}