> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging.auth0-mintlify.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Token

> Get an access token to call a Resource App's API on the end-user's behalf by exchanging an Identity Assertion Authorization Grant (ID-JAG), issued by a trusted Enterprise IdP, as part of the Cross App Access (XAA) flow.

`POST /oauth/token`

Cross App Access (XAA) implements the [Identity Assertion Authorization Grant](https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/), an OAuth extension that lets a Requesting App exchange an ID-JAG — issued by a trusted Enterprise IdP, such as Okta — for an access token scoped to a Resource App's API, on behalf of the shared end-user. To learn more, read the [Cross App Access (XAA) documentation](https://auth0.com/docs/secure/call-apis-on-users-behalf/xaa).

<Note>
  Cross App Access (XAA) for Resource App is in **Early Access**. Enterprise, B2B Pro, and B2B Essential customers can use it as a feature of Enterprise Connections. You can also try it during the trial period on Free tenants. By using this feature, you agree to the applicable Free Trial terms in Okta's [Master Subscription Agreement](https://www.okta.com/legal/?_gl=1*51wq70*_gcl_au*NzczNzM1NjYyLjE3ODE3NzY0MDI.*_ga*MTE3ODU0MTY1Ny4xNzgxNzc2NDAy*_ga_QKMSDV5369*czE3ODQ1NTM3ODckbzgyJGcxJHQxNzg0NTU0NzIxJGo1OCRsMCRoMA..).
</Note>

## Remarks

* The Requesting App must be registered in the Resource App's Auth0 tenant and have the Cross App Access toggle enabled.
* No `refresh_token` or `id_token` is issued for this grant. To get a new access token, the Requesting App can reuse the same ID-JAG as long as it hasn't expired, or request a fresh ID-JAG from the Enterprise IdP.
* ID-JAG exchanges on this endpoint are rate-limited to up to 50% of your tenant's global Authentication API rate limit. To learn more, read [Rate Limit Configurations](/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy/rate-limit-configurations).

## Request Body

<ParamField body="grant_type" type="string" required>
  Denotes the flow you are using. For Cross App Access, use `urn:ietf:params:oauth:grant-type:jwt-bearer`.
</ParamField>

<ParamField body="assertion" type="string" required>
  The ID-JAG JWT issued by the trusted Enterprise IdP for the end-user.
</ParamField>

<ParamField body="client_id" type="string" required>
  The Client ID of the Requesting App registered in the Resource App's Auth0 tenant. As for other grant types, you can also pass the Client ID in the Authorization header using HTTP Basic Auth.
</ParamField>

<ParamField body="client_secret" type="string" required>
  The Client Secret of the Requesting App registered in the Resource App's Auth0 tenant. As for other grant types, you can also pass the Client Secret in the Authorization header using HTTP Basic Auth.
</ParamField>

<ParamField body="scope" type="string">
  (Optional) A space-delimited list of permissions requested for the access token. Subject to RBAC and other authorization policies configured on the target API.
</ParamField>

<ParamField body="resource" type="string">
  (Optional) The resource identifier of the resource server (API) in your Auth0 tenant. If the ID-JAG assertion includes a `resource` claim, that value takes precedence over this parameter. If no resource is specified in the ID-JAG or in the request body, your tenant's [default audience](https://auth0.com/docs/get-started/tenant-settings#api-authorization-settings) is used.
</ParamField>

## Response

| Status | Description                                                                                                                       |
| ------ | --------------------------------------------------------------------------------------------------------------------------------- |
| 200    | Successful response. Returns an access token scoped to the target API.                                                            |
| 400    | Bad request. May occur if the assertion is malformed, expired, or missing required claims, or if required parameters are missing. |
| 401    | Unauthorized. The client credentials are incorrect, or the assertion's signature could not be validated.                          |
| 403    | Forbidden. The client is not enabled for Cross App Access, or the requested scopes are not permitted.                             |

<ResponseExample>
  ```json 200 Response theme={null}
  {
    "access_token": "eyJ...",
    "expires_in": 86400,
    "token_type": "Bearer",
    "scope": "read:items write:items"
  }
  ```

  ```json 400 Response (Invalid or expired assertion) theme={null}
  {
    "error": "invalid_grant",
    "error_description": "Assertion is invalid or has expired"
  }
  ```
</ResponseExample>

## Response Fields

<ResponseField name="access_token" type="string">
  The Auth0 access token scoped to the target API, issued for the end-user identified in the ID-JAG's `sub` claim.
</ResponseField>

<ResponseField name="token_type" type="string">
  Specifies the authentication scheme to use in the Authorization header. Value: `Bearer`.
</ResponseField>

<ResponseField name="expires_in" type="number">
  The lifetime of the access token in seconds.
</ResponseField>

<ResponseField name="scope" type="string">
  (Optional) Only included if the granted scopes differ from the requested scopes. Space-delimited list of scopes that were actually granted.
</ResponseField>