XAA Environment Setup

To test the end-to-end XAA flow from the Requesting App side, you need two Auth0 tenants:

Requesting App tenant: Your Auth0 tenant, which acts as the Requesting App. Your AI agent or SaaS application is registered here.
Resource App tenant: A separate Auth0 tenant acting as the Resource App Authorization Server. In production, this tenant belongs to the third-party SaaS provider whose API you want to call.

The environment setup covers:

Configure the test Resource App in the Resource App tenant.
Configure the OIDC connection between the Requesting App tenant and the Resource App tenant.

This article only covers the Auth0 environment setup. For the enterprise IdP-side configuration, read the applicable guide in IdP Integration: Okta as OIDC IdP.

Configure the test Resource App

The following steps configure a test Resource App and its API in the Resource App tenant. In production, the third-party SaaS provider completes these steps as part of their XAA Resource App setup.

Create the Resource App

In the Resource App tenant, navigate to Applications > Applications and select Create Application. Enter a name and select Regular Web Application, Native, or Single Page Application depending on the type of application you want to use.

Auth0 Dashboard
Management API

Under Application URIs, add the callback URL of your Requesting App tenant as an Allowed Callback URL: https://YOUR_REQUESTING_APP_DOMAIN/login/callback.
Under Cross App Access, enable Allow Cross App Access.

Under Advanced Settings > Grant Types, select Authorization Code and Refresh Token.
Select Save Changes.

Make a PATCH call to the Update a Client endpoint to add the required grant types, enable Cross App Access, and set the allowed callback URL:

curl --request PATCH 'https://{yourResourceAppDomain}/api/v2/clients/{clientId}' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>' \
  --data '{
    "callbacks": ["https://YOUR_REQUESTING_APP_DOMAIN/login/callback"],
    "cross_app_access": { "active": true },
    "grant_types": [
      "authorization_code",
      "refresh_token"
    ]
  }'

Note the Client ID and Client Secret of the Resource App. You’ll need these when configuring the OIDC connection in your Requesting App tenant. For applications registered using the Client ID Metadata Document (CIMD), use the External Client ID field for the Client ID.

Create the Resource App API

In the Resource App tenant, navigate to Applications > APIs and select Create API.

Enter a name and an identifier for the API. The identifier cannot be changed after creation.
Under Access Settings, select Allow Offline Access.
Under Access Policy for Applications, select All apps allowed or configure per-app authorization as needed for user-delegated and client access.
Set the API identifier as the Default Audience for the Resource App tenant under Tenant Settings.
Select Create.

Configure the OIDC connection

In your Requesting App tenant, create an OIDC Enterprise connection that federates your tenant with the Resource App tenant. This connection enables your tenant, which acts as the Requesting App, to obtain ID-JAGs from the enterprise IdP and exchange them for access tokens from the Resource App.

Auth0 Dashboard
Management API

Navigate to Authentication > Enterprise > OpenID Connect and select Create Connection.

Enter the following:

Field	Value
Connection name	A unique name for the connection, such as `my-resource-app-oidc-connection`.
OIDC Discovery URL	The discovery URL of the Resource App tenant: `https://YOUR_RESOURCE_APP_DOMAIN/.well-known/openid-configuration`.
Client ID	The Client ID of the Resource App application in the Resource App tenant.
Client Secret	The Client Secret of the Resource App application in the Resource App tenant.

Under Purpose, select Authentication and Connected Accounts for Token Vault to allow this connection to be used for user login and secure token management with Token Vault.
Under Cross App Access:
- Under Cross App Access Roles, select Requesting Application.
- Under Cross App Access for Token Vault, select Enable Cross App Access for Token Vault to authorize Token Vault to retrieve and store access tokens from the Resource App on the user’s behalf.
Select Create.

Make a POST call to the Create a Connection endpoint:

curl --request POST 'https://{yourDomain}/api/v2/connections' \
  --header 'Content-Type: application/json' \
  --header 'Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>' \
  --data '{
    "name": "my-resource-app-oidc-connection",
    "strategy": "oidc",
    "options": {
      "discovery_url": "https://YOUR_RESOURCE_APP_DOMAIN/.well-known/openid-configuration",
      "client_id": "<RESOURCE_APP_CLIENT_ID>",
      "client_secret": "<RESOURCE_APP_CLIENT_SECRET>",
      "scope": "openid profile email"
    },
    "metadata": {
      "purpose": "connected_accounts"
    },
    "cross_app_access_requesting_app": { "active": true },
    "connected_accounts": {
      "active": true,
      "cross_app_access": true
    }
  }'

Next steps

Once you’ve configured the OIDC connection, proceed to configure the enterprise IdP: Okta as OIDC IdP.

Set up Auth0 as Resource App

Set up Auth0 as Requesting App

XAA Environment Setup

Configure the test Resource App

Create the Resource App

Create the Resource App API

Configure the OIDC connection

Next steps

​Configure the test Resource App

​Create the Resource App

​Create the Resource App API

​Configure the OIDC connection

​Next steps

Configure the test Resource App

Create the Resource App

Create the Resource App API

Configure the OIDC connection

Next steps