Configure the resource app

The resource app contains the protected resources that your AI agent can access on behalf of the user. Create the app integration instance that represents your resource app in Okta before configuring the resource connection.

About this task

If you created your resource app instance from the OIN catalog, it already has Cross App Access (XAA) configured, so you don't have to enable XAA. You can go directly to Configure the Cross App Access connection.

If you created a custom app integration instance for your resource with the App Integration Wizard Classic experience, you need to configure XAA.

The following resource apps are supported:

Custom OIDC app
Custom SAML app
OIN OIDC catalog app - supported only if XAA is enabled
OIN SAML catalog app - supported only if XAA is enabled

For each resource app you want to connect to the AI agent, create a custom or OIN app integration instance in Okta with OIDC or SAML SSO configured. If you use an OIN app as the resource app, it must already have XAA enabled.

Note: To create a custom SSO app integration instance, see Create OpenID Connect app integrations or Create SAML app integrations. To create an OIN app integration instance, see Add existing app integrations .

Procedure

Enable XAA on a custom app integration

In the Admin Console, go to Applications and Resources > Applications.
Select your SSO resource app.
In the Resource Server tab of your app page, click Edit next to Cross App Access (XAA) to enable and configure XAA.
1. Select Enable to grant access to the app through XAA.
2. Specify the following fields:
  - Issuer URL: The base URL of the app's authorization server. Okta uses this URL for token verification requests.
  - Audience/tenant ID: A unique identifier or audience claim for the authorization server that protects the resource.
  Note: Ensure that the app you're registering as the resource server supports XAA.
3. Click Save.

What to do next

Configure the Cross App Access connection