> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging.auth0-mintlify.app/llms.txt
> Use this file to discover all available pages before exploring further.

> Configure your Auth0 tenant as the Requesting App to call third-party APIs on a user's behalf using the Cross App Access flow with tokens stored in Token Vault.

# Set up Auth0 as Requesting App

export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => {
  const stageTextMap = {
    "beta": "Beta",
    "ea": "Early Access"
  };
  const stageText = stageTextMap[stage] || "a product release stage";
  const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages";
  const linkify = (text, url) => {
    return <a href={url} target="_blank" rel="noreferrer" class="link">{text}</a>;
  };
  const includeDetails = (plans, contact, terms) => {
    const hasDetails = terms || plans || contact;
    if (!hasDetails) return null;
    return <span data-as="p">
            {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. </>}
            {contact && "To participate, contact " + contact + ". "}
            {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.</>}
        </span>;
  };
  return <Warning>
            <span data-as="p">
                <strong>The {feature} feature is in {linkify(stageText, prsLink)}.</strong>
            </span>

            {includeDetails(plans, contact, terms)}
        </Warning>;
};

<ReleaseStageNotice feature="Cross App Access (XAA) for the Requesting App" stage="ea" plans="Enterprise, B2B Pro, and B2B Essential" terms="true" />

By configuring your Auth0 tenant as the Requesting App, your AI agent or SaaS application can call third-party APIs on a user's behalf without requiring the user to go through OAuth consent flows. The enterprise IT admin defines and manages the access policy in their identity provider (IdP).

When a user logs into your application through their enterprise IdP, your Auth0 tenant acts as the Requesting App: it obtains an [ID-JAG](https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/) from the enterprise IdP and exchanges it for an access token from the Resource App. Your application uses that access token to call the Resource App's API. Auth0 then stores and reuses the tokens your application retrieves via XAA in [Token Vault](/docs/secure/call-apis-on-users-behalf/token-vault).

## Get started

If you want to set up and test the full XAA flow from the Requesting App side:

1. Complete [Environment Setup](/docs/ai-agents-mcp/cross-app-access/requesting-app/set-up-xaa-test-environment) to configure your test Resource App and the OIDC connection between your Auth0 tenant and the Resource App tenant.
2. Configure the enterprise IdP by following the applicable guide in IdP Integration: [Okta as OIDC IdP](/docs/ai-agents-mcp/cross-app-access/requesting-app/idp/okta-as-oidc-idp).
3. Configure [Token Vault with Cross App Access](/docs/secure/call-apis-on-users-behalf/token-vault/xaa-with-token-vault) to store and reuse the tokens your application retrieves via XAA.

If you've already set up Token Vault and want to add XAA support, read [Cross App Access with Token Vault](/docs/secure/call-apis-on-users-behalf/token-vault/xaa-with-token-vault).