--- title: "Add Cross App Access to Your OIDC Resource Application" url: https://daily.dev/posts/add-cross-app-access-to-your-oidc-resource-application-9yzkctupj source_url: https://developer.okta.com/blog/2026/08/24/xaa-oidc-resource type: article source: "Okta Dev" published: 2026-08-24T16:05:43.276Z updated: 2026-08-24T16:06:05.114Z tags: ["authentication", "jwt", "okta"] reading_time: 16 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Add Cross App Access to Your OIDC Resource Application **[Okta Dev](https://daily.dev/sources/okta)** · 16 min read · 0 upvotes · 0 comments ## Summary A detailed implementation guide walks through adding Cross App Access (XAA) to an existing OIDC-federated resource application. It covers how the Identity Assertion Authorization Grant (ID-JAG) works, how to validate and resolve users from ID-JAG claims (iss, sub, tenant, email), how to issue scoped access tokens without refresh tokens, how to update authorization server metadata, and a full walkthrough for configuring and testing the setup in Okta using xaa.dev. It also notes differences for SAML-federated customers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I validate an ID-JAG token before trusting its signature to prevent forgery? Always resolve the IdP connection from the unverified iss claim first, then verify the JWT signature against that specific connection's JWKS endpoint. Checking the signature before binding the issuer to a registered connection lets an attacker stand up their own IdP, sign a token, and present a sub claim belonging to an existing user, so issuer binding must happen first. _Developers securing app-to-app OIDC flows track validation patterns like this on daily.dev._ ### Why shouldn't a resource authorization server issue a refresh token when using Cross App Access with ID-JAG? Issuing a refresh token gives the client durable access that the identity provider cannot revoke. The ID-JAG itself replaces the refresh token: when the access token expires, the client resubmits the same ID-JAG to the token endpoint for a new access token, and only once the ID-JAG expires does the client return to the IdP for a fresh one. _Teams designing OAuth token lifecycles compare these tradeoffs on daily.dev._ ### How do I uniquely identify a user from the iss and sub claims in an ID-JAG token? The sub claim alone is not unique; resolve on iss plus sub together, since two different identity providers could issue overlapping subject identifiers. If the IdP is multi-tenant, add the tenant claim to the key (iss plus tenant plus sub), because two customers on the same multi-tenant IdP could otherwise collide. _Engineers building multi-tenant identity resolution reference details like this on daily.dev._ ## Similar posts on daily.dev - [Add Cross App Access to Your OIDC Requesting Application](https://daily.dev/posts/add-cross-app-access-to-your-oidc-requesting-application-mzl7e4jav) · Okta Dev · 0 upvotes · 0 comments - [Enabling Cross App Access for SAML-Based Enterprise Apps](https://daily.dev/posts/enabling-cross-app-access-for-saml-based-enterprise-apps-tdsxhdjpf) · Okta Dev · 0 upvotes · 0 comments - [Enable Your SAML Requesting App for Cross App Access](https://daily.dev/posts/enable-your-saml-requesting-app-for-cross-app-access-t4jfwrwat) · Okta Dev · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#jwt](https://daily.dev/tags/jwt), [#okta](https://daily.dev/tags/okta) [View this post on daily.dev](https://daily.dev/posts/add-cross-app-access-to-your-oidc-resource-application-9yzkctupj)