Cross App Access (XAA) enables SAML-federated enterprise apps to securely connect with third-party applications without migrating to OIDC. The flow involves three steps after SSO: exchanging a SAML assertion for an OAuth refresh token, exchanging the refresh token for an Identity Assertion Authorization Grant (ID-JAG) JWT, and redeeming the ID-JAG at the resource app's authorization server for an access token. The guide provides HTTP request examples for each step, covers token expiration handling, and walks through configuring both requesting and resource apps in Okta's Admin Console, including registering an AI Agent to define the relationship between apps and validating the end-to-end flow using xaa.dev.
Table of contents
How XAA in SAML worksXAA implementation checklist for SAML-federated applicationsMaking cross-application requests from your SAML app securelyConfigure your XAA SAML Requesting App in OktaLearn more about Cross App Access, SAML, and OAuth 2.0410 Impressions