Get Token - Auth0 Docs

POST /oauth/token Cross App Access (XAA) implements the Identity Assertion Authorization Grant, an OAuth extension that lets a Requesting App exchange an ID-JAG — issued by a trusted Enterprise IdP, such as Okta — for an access token scoped to a Resource App’s API, on behalf of the shared end-user. To learn more, read the Cross App Access (XAA) documentation.

Cross App Access (XAA) for Resource App is in Early Access. Enterprise, B2B Pro, and B2B Essential customers can use it as a feature of Enterprise Connections. You can also try it during the trial period on Free tenants. By using this feature, you agree to the applicable Free Trial terms in Okta’s Master Subscription Agreement.

Remarks

The Requesting App must be registered in the Resource App’s Auth0 tenant and have the Cross App Access toggle enabled.
No refresh_token or id_token is issued for this grant. To get a new access token, the Requesting App can reuse the same ID-JAG as long as it hasn’t expired, or request a fresh ID-JAG from the Enterprise IdP.
ID-JAG exchanges on this endpoint are rate-limited to up to 50% of your tenant’s global Authentication API rate limit. To learn more, read Rate Limit Configurations.

Request Body

string

required

Denotes the flow you are using. For Cross App Access, use urn:ietf:params:oauth:grant-type:jwt-bearer.

string

required

The ID-JAG JWT issued by the trusted Enterprise IdP for the end-user.

string

required

The Client ID of the Requesting App registered in the Resource App’s Auth0 tenant. As for other grant types, you can also pass the Client ID in the Authorization header using HTTP Basic Auth.

string

required

The Client Secret of the Requesting App registered in the Resource App’s Auth0 tenant. As for other grant types, you can also pass the Client Secret in the Authorization header using HTTP Basic Auth.

string

(Optional) A space-delimited list of permissions requested for the access token. Subject to RBAC and other authorization policies configured on the target API.

string

(Optional) The resource identifier of the resource server (API) in your Auth0 tenant. If the ID-JAG assertion includes a resource claim, that value takes precedence over this parameter. If no resource is specified in the ID-JAG or in the request body, your tenant’s default audience is used.

Response

Status	Description
200	Successful response. Returns an access token scoped to the target API.
400	Bad request. May occur if the assertion is malformed, expired, or missing required claims, or if required parameters are missing.
401	Unauthorized. The client credentials are incorrect, or the assertion’s signature could not be validated.
403	Forbidden. The client is not enabled for Cross App Access, or the requested scopes are not permitted.

{
  "access_token": "eyJ...",
  "expires_in": 86400,
  "token_type": "Bearer",
  "scope": "read:items write:items"
}

{
  "error": "invalid_grant",
  "error_description": "Assertion is invalid or has expired"
}

Response Fields

string

The Auth0 access token scoped to the target API, issued for the end-user identified in the ID-JAG’s sub claim.

string

Specifies the authentication scheme to use in the Authorization header. Value: Bearer.

number

The lifetime of the access token in seconds.

string

(Optional) Only included if the granted scopes differ from the requested scopes. Space-delimited list of scopes that were actually granted.

​Remarks

​Request Body

​Response

​Response Fields

Remarks

Request Body

Response

Response Fields