> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging.auth0-mintlify.app/llms.txt
> Use this file to discover all available pages before exploring further.

> Configure Okta as the OIDC enterprise identity provider for the XAA Requesting App.

# Okta as OIDC IdP

export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => {
  const stageTextMap = {
    "beta": "Beta",
    "ea": "Early Access"
  };
  const stageText = stageTextMap[stage] || "a product release stage";
  const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages";
  const linkify = (text, url) => {
    return <a href={url} target="_blank" rel="noreferrer" class="link">{text}</a>;
  };
  const includeDetails = (plans, contact, terms) => {
    const hasDetails = terms || plans || contact;
    if (!hasDetails) return null;
    return <span data-as="p">
            {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. </>}
            {contact && "To participate, contact " + contact + ". "}
            {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.</>}
        </span>;
  };
  return <Warning>
            <span data-as="p">
                <strong>The {feature} feature is in {linkify(stageText, prsLink)}.</strong>
            </span>

            {includeDetails(plans, contact, terms)}
        </Warning>;
};

<ReleaseStageNotice feature="Cross App Access (XAA) for the Requesting App" stage="ea" plans="Enterprise, B2B Pro, and B2B Essential" terms="true" />

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  This guide assumes you use Okta as your enterprise identity provider (IdP) and have administrative access to an Okta tenant you can use for testing. If you don't have one, read [Create and configure your Okta tenant](#create-and-configure-your-okta-tenant).
</Callout>

Configure Okta as the OIDC enterprise identity provider for the XAA Requesting App. You'll set up an Okta tenant, register the Requesting App and Resource App in Okta, configure an AI Agent, and configure the Okta Workforce Enterprise connections in both the Requesting App and Resource App Auth0 tenants.

## Create and configure your Okta tenant

To create and configure your Okta tenant for Cross App Access:

* On the [Okta Developer website](https://developer.okta.com/signup/), sign up for an **Okta Integrator Free Plan**. Once you sign up, you should be redirected to your new Okta tenant.
* If Cross App Access is not enabled in your Okta tenant, email `developers@okta.com` to request XAA enablement for your Okta tenant.

Once you've enabled Cross App Access, make sure the following features are toggled on under **Okta Admin > Settings > Features** in the Okta Admin Console.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_flags_ea.png" alt="" />
</Frame>

## Register the Requesting App in Okta

### Create the Requesting App in Okta

Your Requesting App is a standard OIDC application. In the Okta Admin Console:

1. Navigate to **Applications and Resources > Applications > Create App Integration**.
2. Select **Classic experience > OIDC - OpenID Connect > Web Application** and select **Next**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_req_app_new_type.png" alt="" />
</Frame>

3. Enter an application name.
4. Under **Grant Type**, select **Authorization Code** and **Refresh Token**.
5. Under **Sign-in redirect URIs**, add the callback URL of your Requesting App tenant: `https://YOUR_REQUESTING_APP_DOMAIN/login/callback`.
6. Configure **Assignments** if needed and select **Save**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/okta_req_app_new_application.png" alt="" />
</Frame>

Once you've created the Requesting App, Okta assigns it an OIDC Client ID and Client Secret.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_req_app_general.png" alt="" />
</Frame>

### Assign the Requesting App to test users

Allow your test user to log in to the Requesting App in Okta.

In the Okta Admin Console:

1. Navigate to **Applications** and select the Requesting App you created.
2. Under **Assignments**, select **Assign > Assign to People** and select your test user.
3. Select **Save**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_req_app_user_assignment.png" alt="" />
</Frame>

## Register and configure the AI agent in Okta

In Okta, the AI agent represents the entity that acts on behalf of the user to access the Resource App. You associate the AI Agent with the Requesting App OIDC application you created. When you do, the AI Agent takes on the Requesting App's OIDC credentials.

### Create the AI agent

In the Okta Admin Console, navigate to **Directory > AI Agents > Register AI Agent** and select **Register Manually**.

1. Enter a name for your agent.
2. Select **Allow users to access this agent**.
3. Under **Select an existing app**, select the Requesting App you created.
4. (Optional) Assign an owner.
5. Select **Save**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_register_ai_agent.png" alt="" />
</Frame>

At this stage, your AI agent is `STAGED`.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_ai_agent_staged.png" alt="" />
</Frame>

### Set client registration for the AI agent

1. Select the AI agent you created.
2. Select the **Client registration** tab.
3. Select **Client Secret** as the authentication method. Private Key JWT is also supported.
4. Note the **Client ID** and **Client Secret** of the AI agent, which should be the Client ID and Client Secret of the Requesting App OIDC Application you created in your Okta tenant. You'll need these when configuring the Okta Workforce connection in your Requesting App tenant.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_req_app_agent_client_registration.png" alt="" />
</Frame>

### Activate the AI Agent

Under **Actions**, select **Activate** and verify that the **Managed Status** is **Active**.

## Configure the Requesting App connection in Auth0

In your Requesting App Auth0 tenant, create an Okta Workforce Enterprise connection. This connection authenticates your users with Okta and enables the XAA Requesting App role.

<Tabs>
  <Tab title="Auth0 Dashboard">
    1. Navigate to **Authentication > Enterprise > Okta Workforce** and select **Create Connection**.

    Enter the following:

    | Field               | Value                                                                                                        |
    | ------------------- | ------------------------------------------------------------------------------------------------------------ |
    | **Connection name** | A unique name for the connection.                                                                            |
    | **Domain**          | The domain of your Okta tenant, for example `your-okta-tenant.oktapreview.com`.                              |
    | **Client ID**       | The **Client ID** of the AI agent (the Requesting App OIDC application you created in your Okta tenant).     |
    | **Client Secret**   | The **Client Secret** of the AI agent (the Requesting App OIDC application you created in your Okta tenant). |

    2. Under **Cross App Access > Cross App Access Role**, select **Requesting Application**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_connection_requesting_app.png" alt="" />
    </Frame>

    <Callout icon="file-lines" color="#0EA5E9" iconType="regular">
      The **Requesting Application** toggle is disabled while the connection uses the front channel. Make sure to set the communication channel to back channel for the connection.
    </Callout>

    3. Select **Create**.
  </Tab>

  <Tab title="Management API">
    Make a `POST` call to the [Create a Connection](https://auth0.com/docs/api/management/v2/connections/post-connections) endpoint:

    ```bash theme={null}
    curl --request POST 'https://{yourDomain}/api/v2/connections' \
      --header 'Content-Type: application/json' \
      --header 'Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>' \
      --data '{
        "name": "my-okta-workforce-connection",
        "strategy": "okta",
        "options": {
          "domain": "your-okta-tenant.oktapreview.com",
          "client_id": "<AI_AGENT_CLIENT_ID>",
          "client_secret": "<AI_AGENT_CLIENT_SECRET>",
          "scope": "openid profile email offline_access",
          "type": "back_channel",
          "attribute_map": {
            "mapping_mode": "use_map",
            "userinfo_scope": "openid email profile groups offline_access",
            "attributes": {
              "name": "${context.tokenset.name}",
              "email": "${context.tokenset.email}",
              "username": "${context.tokenset.preferred_username}",
              "federated_groups": "${context.userinfo.groups}",
              "federated_locale": "${context.userinfo.locale}",
              "federated_zoneinfo": "${context.userinfo.zoneinfo}"
            }
          }
        },
        "cross_app_access_requesting_app": { "active": true }
      }'
    ```
  </Tab>
</Tabs>

### Add offline\_access scope and update the user mapping

<Tabs>
  <Tab title="Auth0 Dashboard">
    After creating the connection, select it and navigate to **Settings**.

    1. Under **Scopes**, add `offline_access` to the list of scopes. This enables your application to obtain a refresh token, which is required to perform the [refresh token exchange with Token Vault](/docs/secure/call-apis-on-users-behalf/token-vault/refresh-token-exchange-with-token-vault).
    2. Under **Mappings**, select **Okta Basic** and add `offline_access` to the `userinfo_scope` list in the JSON mapping.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_user_mapping.png" alt="" />
    </Frame>

    3. Select **Save**.
  </Tab>

  <Tab title="Management API">
    Make a `PATCH` call to the [Update a Connection](https://auth0.com/docs/api/management/v2/connections/patch-connections-by-id) endpoint:

    ```bash theme={null}
    curl --request PATCH 'https://{yourDomain}/api/v2/connections/{connectionId}' \
      --header 'Content-Type: application/json' \
      --header 'Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>' \
      --data '{
        "options": {
          "scope": "openid profile email offline_access",
          "attribute_map": {
            "mapping_mode": "use_map",
            "userinfo_scope": "openid email profile groups offline_access",
            "attributes": {
              "name": "${context.tokenset.name}",
              "email": "${context.tokenset.email}",
              "username": "${context.tokenset.preferred_username}",
              "federated_groups": "${context.userinfo.groups}",
              "federated_locale": "${context.userinfo.locale}",
              "federated_zoneinfo": "${context.userinfo.zoneinfo}"
            }
          }
        }
      }'
    ```
  </Tab>
</Tabs>

### Enable connection for an application

<Tabs>
  <Tab title="Auth0 Dashboard">
    Before testing the connection, navigate to the **Applications** tab and enable the connection for at least one application.
  </Tab>

  <Tab title="Management API">
    Make a `PATCH` call to the [Update a Connection](https://auth0.com/docs/api/management/v2/connections/patch-connections-by-id) endpoint to add the application's `client_id` to the `enabled_clients` array:

    ```bash theme={null}
    curl --request PATCH 'https://{yourDomain}/api/v2/connections/{connectionId}' \
      --header 'Content-Type: application/json' \
      --header 'Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>' \
      --data '{
        "enabled_clients": ["{yourApplicationClientId}"]
      }'
    ```
  </Tab>
</Tabs>

### Test the connection

1. Select the Okta Workforce connection you created, then select the three dots and select **Try**.
2. Log in with your test user in Okta to verify the connection works.

Once the user successfully logs in, their user profile is created in your Requesting App tenant.

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  Users must log in with a XAA-enabled enterprise connection at least once so that the user profile exists in Auth0. Auth0 does not support JIT user creation with ID-JAG at the moment.
</Callout>

## Register the Resource App in Okta

### Create the Resource App in Okta

Your Resource App is also an OIDC web application registered in Okta. In the Okta Admin Console:

1. Navigate to **Applications and Resources > Applications > Create App Integration**.
2. Select **Classic experience > OIDC - OpenID Connect > Web Application** and select **Next**.
3. Enter an application name.
4. Under **Grant Type**, select **Authorization Code** and **Refresh Token**.
5. Under **Sign-in redirect URIs**, add the callback URLs of both the Requesting App tenant and the Resource App tenant:
   * `https://YOUR_REQUESTING_APP_DOMAIN/login/callback`
   * `https://YOUR_RESOURCE_APP_DOMAIN/login/callback`
6. Configure **Assignments** if needed.
7. Select **Save**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_resource_app_details.png" alt="" />
</Frame>

### Assign Resource App to Test Users

Allow your test user to log in to the Resource App in Okta.

In the Okta Admin Console:

1. Navigate to **Applications** and select the Resource App you created.
2. Select **Assign > Assign to People** and select your test user.
3. Select **Save**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_resource_app_user_assignment.png" alt="" />
</Frame>

### Enable Cross App Access for the Resource App

1. Select the **Resource Server** tab for the Resource App.
2. Enable **Cross App Access (XAA)**.
3. Enter the **Issuer URL** of the Resource App tenant: `https://YOUR_RESOURCE_APP_DOMAIN/`.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_resource_app_resource_server.png" alt="" />
</Frame>

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  Auth0 issues and accepts tokens with an issuer URL that must end with a trailing forward slash **`/`**.
</Callout>

4. Leave the **Audience/Tenant ID** field blank. Auth0 does not support the `aud_tenant` claim.
5. Select **Save**.

### Assign the Resource App to the AI agent

In the Okta Admin Console:

1. Navigate to **Directory > AI Agents** and select the AI agent you created.
2. Under **Resource Connections**, select **Add resource connection**.
3. Select **Application** and then **App configured for AI Agent access** as the **Resource type**.
4. Under **Application**, select the Resource App you created.
5. Leave the **Resource indicator** blank. When left blank, Okta will auto-generate a value.
6. For **AI agent's client ID registered in this app**, enter the **Client ID** of the Resource App application registered in your Resource App Auth0 tenant.
7. Optionally, configure scope restrictions.
8. Select **Add**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_ai_agent_resource_connections_tab.png" alt="" />
</Frame>

## Configure the Resource App connection in Auth0

In the Resource App Auth0 tenant, create an Okta Workforce Enterprise connection that federates it with Okta and enables the XAA Resource App role.

<Tabs>
  <Tab title="Auth0 Dashboard">
    1. Navigate to **Authentication > Enterprise > Okta Workforce** and select **Create Connection**.

    Enter the following:

    | Field               | Value                                                                           |
    | ------------------- | ------------------------------------------------------------------------------- |
    | **Connection name** | A unique name for the connection.                                               |
    | **Domain**          | The domain of your Okta tenant, for example `your-okta-tenant.oktapreview.com`. |
    | **Client ID**       | The **Client ID** of the Resource App as registered in Okta.                    |
    | **Client Secret**   | The **Client Secret** of the Resource App as registered in Okta.                |

    2. Under **Cross App Access > Cross App Access Role**, select **Resource Application**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_connection_resource_application.png" alt="" />
    </Frame>

    3. Select **Create**.
  </Tab>

  <Tab title="Management API">
    Make a `POST` call to the [Create a Connection](https://auth0.com/docs/api/management/v2/connections/post-connections) endpoint:

    ```bash theme={null}
    curl --request POST 'https://{yourResourceAppDomain}/api/v2/connections' \
      --header 'Content-Type: application/json' \
      --header 'Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>' \
      --data '{
        "name": "my-okta-workforce-connection-resource-app",
        "strategy": "okta",
        "options": {
          "domain": "your-okta-tenant.oktapreview.com",
          "client_id": "<RESOURCE_APP_OKTA_CLIENT_ID>",
          "client_secret": "<RESOURCE_APP_OKTA_CLIENT_SECRET>",
          "scope": "openid profile email offline_access",
          "attribute_map": {
            "mapping_mode": "use_map",
            "userinfo_scope": "openid email profile groups offline_access",
            "attributes": {
              "name": "${context.tokenset.name}",
              "email": "${context.tokenset.email}",
              "username": "${context.tokenset.preferred_username}",
              "federated_groups": "${context.userinfo.groups}",
              "federated_locale": "${context.userinfo.locale}",
              "federated_zoneinfo": "${context.userinfo.zoneinfo}"
            }
          }
        },
        "cross_app_access_resource_app": { "active": true }
      }'
    ```
  </Tab>
</Tabs>

### Add offline\_access scope and update mappings

<Tabs>
  <Tab title="Auth0 Dashboard">
    After creating the connection, select it and navigate to **Settings**.

    1. Under **Scopes**, add `offline_access` to the list of scopes.
    2. Under **Mappings**, select **Okta Basic** and add `offline_access` to the `userinfo_scope` list in the JSON mapping.
    3. Select **Save**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/docs-staging/docs/images/xaa/xaa_okta_user_mapping.png" alt="" />
    </Frame>
  </Tab>

  <Tab title="Management API">
    Make a `PATCH` call to the [Update a Connection](https://auth0.com/docs/api/management/v2/connections/patch-connections-by-id) endpoint:

    ```bash theme={null}
    curl --request PATCH 'https://{yourResourceAppDomain}/api/v2/connections/{connectionId}' \
      --header 'Content-Type: application/json' \
      --header 'Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>' \
      --data '{
        "options": {
          "scope": "openid profile email offline_access",
          "attribute_map": {
            "mapping_mode": "use_map",
            "userinfo_scope": "openid email profile groups offline_access",
            "attributes": {
              "name": "${context.tokenset.name}",
              "email": "${context.tokenset.email}",
              "username": "${context.tokenset.preferred_username}",
              "federated_groups": "${context.userinfo.groups}",
              "federated_locale": "${context.userinfo.locale}",
              "federated_zoneinfo": "${context.userinfo.zoneinfo}"
            }
          }
        }
      }'
    ```
  </Tab>
</Tabs>

### Enable the connection for the Resource App

<Tabs>
  <Tab title="Auth0 Dashboard">
    Under **Applications**, enable the Okta Workforce connection for the Resource App application registered in the Resource App tenant.
  </Tab>

  <Tab title="Management API">
    Make a `PATCH` call to the [Update a Connection](https://auth0.com/docs/api/management/v2/connections/patch-connections-by-id) endpoint to add the Resource App's `client_id` to the `enabled_clients` array:

    ```bash theme={null}
    curl --request PATCH 'https://{yourResourceAppDomain}/api/v2/connections/{connectionId}' \
      --header 'Content-Type: application/json' \
      --header 'Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>' \
      --data '{
        "enabled_clients": ["{resourceAppClientId}"]
      }'
    ```
  </Tab>
</Tabs>

### Test the connection

Select the Okta Workforce connection you created, then select the three dots and select **Try**. Log in with your test user to verify the connection works. Once the user successfully logs in, their user profile is created in your Resource App tenant.

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  Users must log in with a XAA-enabled enterprise connection at least once so that the user profile exists in Auth0. Auth0 does not support JIT user creation with ID-JAG at the moment.
</Callout>

## Configure Cross App Access with Token Vault

Once you've configured both connections, proceed to [Cross App Access with Token Vault](/docs/secure/call-apis-on-users-behalf/token-vault/xaa-with-token-vault) to set up the Token Vault integration and test the end-to-end flow.

## Publish your Requesting App in OIN

After you’ve configured and tested the [end-to-end flow](/docs/secure/call-apis-on-users-behalf/token-vault/xaa-with-token-vault), B2B and SaaS providers can amplify their reach to enterprise customers by publishing their Resource App to the [Okta Integration Network (OIN)](https://www.okta.com/integrations/?_gl=1*1vd3mhi*_gcl_aw*R0NMLjE3ODE2MjcxNzYuQ2p3S0NBanc2TVBSQmhCVEVpd0FkLTdNcngzNWlQaTNqRXFXdGQ2VFhONHZuenhPZF9yZ3ZPV1MxQUI4Z2x4emlWSnNmOTNSUmhvZDBSb0NaYUFRQXZEX0J3RQ..*_gcl_au*MTUzNjc2MzkxNS4xNzg2NzI2NTY1*_ga*NTA2NDgyMjM0LjE3NjMwODIxNDg.*_ga_QKMSDV5369*czE3ODc2Nzc5MDYkbzI0NiRnMSR0MTc4NzY3NzkzNCRqMzIkbDAkaDA.). To learn how, follow the instructions in [How to Build and List Secure Cross App Access Connections on OIN](https://developer.okta.com/blog/2026/07/06/submit-oin-xaa?_gl=1*1vd3mhi*_gcl_aw*R0NMLjE3ODE2MjcxNzYuQ2p3S0NBanc2TVBSQmhCVEVpd0FkLTdNcngzNWlQaTNqRXFXdGQ2VFhONHZuenhPZF9yZ3ZPV1MxQUI4Z2x4emlWSnNmOTNSUmhvZDBSb0NaYUFRQXZEX0J3RQ..*_gcl_au*MTUzNjc2MzkxNS4xNzg2NzI2NTY1*_ga*NTA2NDgyMjM0LjE3NjMwODIxNDg.*_ga_QKMSDV5369*czE3ODc2Nzc5MDYkbzI0NiRnMSR0MTc4NzY3NzkzNCRqMzIkbDAkaDA.).