Add Cross App Access to Your OIDC Resource Application
Okta, Monday, August 24th, 2026
Okta guides OIDC resource applications through implementing Cross App Access using the Identity Assertion Authorization Grant.
This Okta guide targets developers who federate enterprise customers using OpenID Connect and want to let applications access their API on behalf of those users. Cross App Access is built on the Identity Assertion Authorization Grant specification, which was designed with OIDC in mind.
The key insight is that the authorization server already trusts the customer's identity provider for single sign-on, and XAA reuses that same trust relationship for API access rather than establishing a separate one.
The guide details what a resource application must support, how to validate the grant, and how to resolve the user at the resource authorization server.