--- title: "Setting Up and Testing Cross App Access (XAA) in Auth0" url: https://daily.dev/posts/setting-up-and-testing-cross-app-access-xaa-in-auth0-rdbk9hf6k source_url: https://auth0.com/blog/setting-up-testing-cross-app-access-auth0 type: article source: "Auth0" published: 2026-08-20T14:12:55.108Z updated: 2026-08-20T14:35:13.384Z tags: ["authentication", "mcp", "oauth", "auth0", "okta"] reading_time: 10 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Setting Up and Testing Cross App Access (XAA) in Auth0 **[Auth0](https://daily.dev/sources/auth0)** · 10 min read · 0 upvotes · 0 comments ## Summary A step-by-step guide walks through configuring Cross App Access (XAA), the protocol behind MCP's Enterprise-Managed Auth, using Auth0 as the Resource App Authorization Server and Okta as the enterprise identity provider. XAA lets IT admins centrally control which AI agents (like Claude or Cursor) can access which APIs and MCP servers, removing per-user consent screens. The flow involves a series of token exchanges: authenticating with the IdP, exchanging a SAML assertion or ID token for an Identity Assertion JWT Authorization Grant (ID-JAG) scoped to the Resource App, then exchanging that ID-JAG at Auth0 for a normal access token used to call the API. The post also covers configuring the open-source XAA Inspector tool to trace each request/response, and describes publishing an XAA integration to the Okta Integration Network (OIN) for easier enterprise discovery. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is an ID-JAG in Cross App Access (XAA)? An ID-JAG, or Identity Assertion JWT Authorization Grant, is an assertion issued by the enterprise identity provider that authorizes cross-domain access to resources. It carries claims like iss (the IdP issuing it), aud (the target Auth0 tenant), sub (the user), client_id (the requesting app, often a CIMD identifier), and scope (granted permissions, which the IdP's policy may narrow down). _Teams wiring AI agents into enterprise auth flows follow token-exchange breakdowns like this on daily.dev._ ### How do I set up Auth0 as a Resource App for Cross App Access with Okta as the SAML identity provider? Configuring Auth0 as an XAA Resource App requires no code, just a toggle on an Enterprise Connection and the relevant client. You need an API representing the resource, a Requesting Application client with Cross App Access enabled, and a SAML Enterprise Connection pointing to Okta's SAML Resource Application, also with Cross App Access enabled so Auth0 trusts Okta's assertions. _Engineers rolling out enterprise-managed AI agent access track setup guides like this on daily.dev._ ### Why can't traditional OAuth give enterprise IT admins centralized control over which AI agents access company APIs? Traditional OAuth requires every individual user to click through a consent screen for each connected app, which means the decision about which AI agents can access which tools is made per-user rather than centrally by IT. This leaves admins without a single place to audit or revoke access, which is the gap that Cross App Access (XAA) and MCP's Enterprise-Managed Auth extension are designed to close. _Developers evaluating agent permission models can follow this kind of authorization design discussion on daily.dev._ ## Similar posts on daily.dev - [Adopting the Cross App Access Protocol in Auth0](https://daily.dev/posts/adopting-the-cross-app-access-protocol-in-auth0-a9xr9ozv8) · Auth0 · 0 upvotes · 0 comments - [Build a Secure C\# MCP App with Cross App Access \(XAA\)](https://daily.dev/posts/build-a-secure-c-mcp-app-with-cross-app-access-xaa--tsx6btqlc) · Okta Dev · 1 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#mcp](https://daily.dev/tags/mcp), [#oauth](https://daily.dev/tags/oauth), [#auth0](https://daily.dev/tags/auth0), [#okta](https://daily.dev/tags/okta) [View this post on daily.dev](https://daily.dev/posts/setting-up-and-testing-cross-app-access-xaa-in-auth0-rdbk9hf6k)