--- title: Enabling Enterprise-Managed Authorization for Client... description: Auth0 has launched Early Access for Client App (Requesting App) capabilities, enabling Cross App Access (XAA) so B2B SaaS apps and AI agents can access... canonical: https://daily.dev/posts/enabling-enterprise-managed-authorization-for-client-apps-in-auth0-vwlz16khq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Enabling Enterprise-Managed Authorization for Client Apps in Auth0 | daily.dev og:description: Auth0 has launched Early Access for Client App (Requesting App) capabilities, enabling Cross App Access (XAA) so B2B SaaS apps and AI agents can access... og:url: https://daily.dev/posts/enabling-enterprise-managed-authorization-for-client-apps-in-auth0-vwlz16khq og:image: https://api.daily.dev/og/posts/VWlZ16khq.png og:image:alt: Enabling Enterprise-Managed Authorization for Client Apps in Auth0 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Enabling Enterprise-Managed Authorization for Client Apps in Auth0 **[Auth0](https://daily.dev/sources/auth0)** · 6 min read · 0 upvotes · 0 comments ## Summary Auth0 has launched Early Access for Client App (Requesting App) capabilities, enabling Cross App Access (XAA) so B2B SaaS apps and AI agents can access enterprise data without disruptive reconnect prompts or risky static API keys. Built on the MCP Enterprise-Managed Authorization extension and the IETF ID-JAG draft spec, Auth0's Token Vault silently brokers token exchanges between a corporate IdP (like Okta) and downstream Resource Apps. Setup involves enabling XAA on the enterprise connection, enabling identity assertion grants on target resources, and calling a federated token-exchange endpoint. Publishing to the Okta Integration Network extends reach to Okta's enterprise customer base. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Cross App Access (XAA) in Auth0 and how does it work? Cross App Access is an Auth0 feature, now in Early Access for Client Apps, that lets an app or AI agent use an employee's existing corporate SSO login to access another app's API without a separate reconnect prompt. It relies on the MCP Enterprise-Managed Authorization extension and the IETF ID-JAG draft spec, where the corporate identity provider issues a short-lived signed assertion that Auth0 verifies before issuing a standard access token. _daily.dev surfaces updates like this for teams wiring enterprise SSO into AI agent authorization flows._ ### How does Auth0 Token Vault avoid repeated token exchanges for Cross App Access? Token Vault stores the upstream enterprise refresh token obtained at login and silently brokers subsequent exchanges, since Resource Apps do not issue long-lived refresh tokens for ID-JAG exchanges. When a client app needs external data, Token Vault fetches a fresh ID-JAG assertion, completes the downstream exchange with the target Resource App, and returns a valid access token to the backend automatically, without user prompts or manual admin steps. _engineers automating enterprise token exchanges can follow this kind of implementation detail on daily.dev._ ### What API call does a client app make to get a downstream access token via Auth0 federated token exchange? A backend calls the standard Auth0 /oauth/token endpoint with grant_type set to urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token, passing the user's Auth0 access token as subject_token along with the target connection name and resource URL. Auth0's Token Vault then validates the session, retrieves the ID-JAG assertion, and returns the API access token for the specified downstream service. _developers implementing federated token exchange can track this kind of integration guidance on daily.dev._ ## Similar posts on daily.dev - [Setting Up and Testing Cross App Access \(XAA\) in Auth0](https://daily.dev/posts/setting-up-and-testing-cross-app-access-xaa-in-auth0-rdbk9hf6k) · Auth0 · 0 upvotes · 0 comments - [Adopting the Cross App Access Protocol in Auth0](https://daily.dev/posts/adopting-the-cross-app-access-protocol-in-auth0-a9xr9ozv8) · Auth0 · 0 upvotes · 0 comments - [Develop a XAA-Enabled Resource Application and Test with Okta](https://daily.dev/posts/develop-a-xaa-enabled-resource-application-and-test-with-okta-q1lbpxnjh) · Okta Dev · 0 upvotes · 0 comments - [Enable Your SAML Requesting App for Cross App Access](https://daily.dev/posts/enable-your-saml-requesting-app-for-cross-app-access-t4jfwrwat) · Okta Dev · 0 upvotes · 0 comments - [Enabling Cross App Access for SAML-Based Enterprise Apps](https://daily.dev/posts/enabling-cross-app-access-for-saml-based-enterprise-apps-tdsxhdjpf) · Okta Dev · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#mcp](https://daily.dev/tags/mcp), [#oauth](https://daily.dev/tags/oauth), [#auth0](https://daily.dev/tags/auth0) [View this post on daily.dev](https://daily.dev/posts/enabling-enterprise-managed-authorization-for-client-apps-in-auth0-vwlz16khq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Enabling Enterprise-Managed Authorization for Client Apps in Auth0","url":"https://daily.dev/posts/enabling-enterprise-managed-authorization-for-client-apps-in-auth0-vwlz16khq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/enabling-enterprise-managed-authorization-for-client-apps-in-auth0-vwlz16khq"},"datePublished":"2026-09-01T16:02:50.125Z","dateModified":"2026-09-01T16:09:38.959Z","description":"Auth0 has launched Early Access for Client App (Requesting App) capabilities, enabling Cross App Access (XAA) so B2B SaaS apps and AI agents can access...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b508863c91a76c306afa2fff0befa3f7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b508863c91a76c306afa2fff0befa3f7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Auth0","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Auth0","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/6510ffa7350449618fbacdddae663b82","url":"https://daily.dev/sources/auth0"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/enabling-enterprise-managed-authorization-for-client-apps-in-auth0-vwlz16khq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,mcp,oauth,auth0","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Auth0","item":"https://daily.dev/sources/auth0"},{"@type":"ListItem","position":3,"name":"Enabling Enterprise-Managed Authorization for Client Apps in Auth0"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/enabling-enterprise-managed-authorization-for-client-apps-in-auth0-vwlz16khq#faq","mainEntity":[{"@type":"Question","name":"What is Cross App Access (XAA) in Auth0 and how does it work?","acceptedAnswer":{"@type":"Answer","text":"Cross App Access is an Auth0 feature, now in Early Access for Client Apps, that lets an app or AI agent use an employee's existing corporate SSO login to access another app's API without a separate reconnect prompt. It relies on the MCP Enterprise-Managed Authorization extension and the IETF ID-JAG draft spec, where the corporate identity provider issues a short-lived signed assertion that Auth0 verifies before issuing a standard access token. daily.dev surfaces updates like this for teams wiring enterprise SSO into AI agent authorization flows."}},{"@type":"Question","name":"How does Auth0 Token Vault avoid repeated token exchanges for Cross App Access?","acceptedAnswer":{"@type":"Answer","text":"Token Vault stores the upstream enterprise refresh token obtained at login and silently brokers subsequent exchanges, since Resource Apps do not issue long-lived refresh tokens for ID-JAG exchanges. When a client app needs external data, Token Vault fetches a fresh ID-JAG assertion, completes the downstream exchange with the target Resource App, and returns a valid access token to the backend automatically, without user prompts or manual admin steps. engineers automating enterprise token exchanges can follow this kind of implementation detail on daily.dev."}},{"@type":"Question","name":"What API call does a client app make to get a downstream access token via Auth0 federated token exchange?","acceptedAnswer":{"@type":"Answer","text":"A backend calls the standard Auth0 /oauth/token endpoint with grant_type set to urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token, passing the user's Auth0 access token as subject_token along with the target connection name and resource URL. Auth0's Token Vault then validates the session, retrieves the ID-JAG assertion, and returns the API access token for the specified downstream service. developers implementing federated token exchange can track this kind of integration guidance on daily.dev."}}]} ```