The resource app contains the protected resources that your AI agent can access on behalf of the user. Create the app integration instance that represents your resource app in Okta before configuring the resource connection.
Before you begin
- Ensure that the resource app instance exists in your Okta org.
- Ensure that the app you're registering as the resource server supports Cross App Access (XAA).
The following resource apps are supported:
Procedure
-
In the Admin Console, go to .
-
Select your SSO resource app. Confirm that the app you're registering as the resource server supports XAA.
-
In the Machine Assignments tab of your app page, select the Callers tile. The Callers page appears for you to specify the access method for callers to your resource app.
-
Click Edit next to Cross App Access (XAA).
-
Select Enable to grant access to the app through XAA.
-
Specify the following fields:
-
Issuer URL: The base URL of the app's authorization server. Okta uses this URL for token verification requests.
-
Audience/tenant ID: A unique identifier or audience claim for the authorization server that protects the resource.
-
Scopes: The scopes that the resource app allows the callers to access. Specify one scope in the text field. Click + Add to add more scopes. You can add up to 100 scopes.
Note: Specify these fields for custom SSO app instances. For app instances created from the OIN, Issuer URL and Scopes are set by the vendor. You can edit the Audience/tenant ID field for OIN app instances.
-
Click Save.