Configure Cross App Access
If you've configured Cross App Access (XAA) in Okta with the Enable Connect with Okta Early Access feature, your existing configuration will stop working soon. The Manage Connections tab on the app's profile will no longer be available after the Enable Connect with Okta features stops working. Reconfigure your XAA configuration for the AI agent-to-app use case. See Configure AI agent-to-app with XAA.
Cross App Access is a protocol that simplifies how third-party apps share data, moving complex consent processes away from end users and into the Okta Admin Console. When XAA is configured, end users can access their data from other SaaS apps without navigating OAuth consent flows. Instead, admins manage this connection on behalf of users in the Okta Admin Console. XAA enhances org security and improves the end-user experience.
Benefits
- Enhanced security: Okta admins have centralized control over data sharing, enforcing least privilege, and reducing the risk of unauthorized access.
- Improved user experience: End users don't encounter repetitive OAuth consent pages, leading to a smoother, more efficient workflow.
- Simplified integration: Cross App Access optimizes the process of connecting third-party apps in your Okta environment.
How it works
Before you begin using this functionality, you should familiarize yourself with these concepts:
- Requesting app (client): The app that accesses a protected resource.
- Resource app: The app that owns protected resources, such as API resources.
- Resource authorization server: The authorization server that protects the resource app.
- Resource connection: A directional relationship between a requesting app and a resource app. Okta admins configure the relationship through the Resource connection tab.
- Identity Assertion JWT Authorization Grant: A token exchange flow that trades the user ID assertion at the IdP for an ID-JAG token. The requesting app uses the ID-JAG token to request an access token from the resource app. This access token is used to request protected resources.
You can configure Cross App Access if your org is subscribed to the Single Sign-On product.
Get started