--- title: "Add Cross App Access to Your OIDC Requesting Application" url: https://daily.dev/posts/add-cross-app-access-to-your-oidc-requesting-application-mzl7e4jav source_url: https://developer.okta.com/blog/2026/08/21/xaa-oidc-requesting type: article source: "Okta Dev" published: 2026-08-21T15:26:56.736Z updated: 2026-08-21T15:35:54.453Z tags: ["authentication", "authorization", "okta"] reading_time: 11 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Add Cross App Access to Your OIDC Requesting Application **[Okta Dev](https://daily.dev/sources/okta)** · 11 min read · 0 upvotes · 0 comments ## Summary A step-by-step implementation guide for adding Cross App Access (XAA) to an OIDC requesting application. XAA, based on the IETF Identity Assertion Authorization Grant spec, lets an app exchange its refresh token for a short-lived ID-JAG token, then redeem that ID-JAG for an access token from a third-party resource app's authorization server. The guide walks through requesting the ID-JAG via OAuth 2.0 Token Exchange (RFC 8693), redeeming it using the JWT Bearer grant (RFC 7523), handling token expiration, and configuring the requesting app, a test resource app, and an AI Agent in Okta, followed by end-to-end validation using xaa.dev. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I exchange a refresh token for an ID-JAG token in Okta's Cross App Access flow? Send a POST request to Okta's /oauth2/v1/token endpoint using grant_type urn:ietf:params:oauth:grant-type:token-exchange, with the refresh token as subject_token, requested_token_type set to urn:ietf:params:oauth:token-type:id-jag, plus the resource app's audience, resource URL, and required scope. Authenticate with client_secret_post using your OIDC app's client ID and secret, following the OAuth 2.0 Token Exchange mechanism defined in RFC 8693. _daily.dev helps engineers wiring up OAuth token exchange flows keep the exact grant parameters straight._ ### What is an ID-JAG token used for in Cross App Access (XAA)? An ID-JAG (Identity Assertion Authorization Grant) is a short-lived, signed JWT issued by an identity provider that lets an application request an access token from a third-party resource app's authorization server without the user re-authenticating there. It is obtained via token exchange using the app's refresh token, then redeemed at the resource server's token endpoint using the JWT Bearer grant defined in RFC 7523. _Developers evaluating app-to-app authorization patterns can track specs like this one on daily.dev._ ### What happens when an ID-JAG token expires during a Cross App Access flow? When an ID-JAG expires, request a new one using the same refresh token, since ID-JAGs are intentionally short-lived while refresh tokens remain long-lived across many exchanges. If the identity provider instead rejects the refresh token itself with an invalid_grant error, the refresh token has expired or been revoked, and the user must sign in again to obtain a fresh one. _daily.dev keeps identity engineers current on token lifecycle patterns like refresh and expiration handling._ ## Similar posts on daily.dev - [Enable Your SAML Requesting App for Cross App Access](https://daily.dev/posts/enable-your-saml-requesting-app-for-cross-app-access-t4jfwrwat) · Okta Dev · 0 upvotes · 0 comments - [What is Cross-App Access \(XAA\) and How It Works](https://daily.dev/posts/what-is-cross-app-access-xaa-and-how-it-works-hm360dpyi) · Descope · 0 upvotes · 0 comments - [Enabling Cross App Access for SAML-Based Enterprise Apps](https://daily.dev/posts/enabling-cross-app-access-for-saml-based-enterprise-apps-tdsxhdjpf) · Okta Dev · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#authorization](https://daily.dev/tags/authorization), [#okta](https://daily.dev/tags/okta) [View this post on daily.dev](https://daily.dev/posts/add-cross-app-access-to-your-oidc-requesting-application-mzl7e4jav)