Configure resource server connectors

Configure an app's resource server connector so you can create a resource connection between the app and an AI agent.

Resource server connectors support two access methods:

Cross-app access (XAA) (recommended): Allows AI agents to connect to the app without prompting users for consent.
Security token exchange (STS): Uses admin-configured credentials to connect an AI agent to the app, and then prompts users for their consent.

Note:

If a resource server connector has more than 500 scopes, you can't view or edit them from the Resource server tab. If the client app doesn't support scopes, the resource server connector inherits the client's permissions. You can't view or edit the inherited scopes in Okta.

Before you begin

You have an admin role with permission to manage apps.
You've registered a client app with the third party app provider. See Prerequisites for common resource server connectors.
You've integrated the app in your org. See Add existing app integrations.

Start this task

In the Admin Console, go to Applications > Applications.
Search for and select an app that has a resource server connector.
Go to the Resource server tab.
Select Cross-app access (XAA) to configure this access method.
1. Select Enable to grant access to the app through Cross-app access.
2. Complete the following fields:
  1. Resource URL: The base URL of the app's resource server.
  2. Issuer URL: The base URL of the app's authorization server. Okta uses this URL to detect token verification requests.
  3. Audience/tenant ID: A unique identifier or audience claim for the authorization server that protects the resource.
3. Click Save.
Select Security token service (STS) to configure this access method.
1. Select Enable to grant access to the app through a security token service.
2. Enter a Client ID and Client secret for the client app that you registered with the resource server connector.
3. If the client app supports scopes, the Scopes field appears. Add the scopes that you want to grant to the resource server.
4. Click Save.
Click Save.
Optional. Use Edit button to modify your configurations.
Note:
If you modify the STS scopes later, any users who are in an active session with that AI agent must reauthenticate and accept consent. Then the AI agent can perform subsequent actions on their behalf.