Skip to main content
To test the end-to-end XAA flow, your Requesting App exchanges an ID token for an ID-JAG at the enterprise IdP, then presents that ID-JAG to the Resource App’s authorization server for an access token. Before testing, make sure you:
  • Update the Redirect URI field to the callback URL of your testing application that acts as your Requesting App in your Okta tenant, as explained in Register the Requesting App in Okta.
  • Provide your Okta representative with the following information:
    • The issuer URL of your Auth0 tenant. Your Resource App is associated with the issuer URL in the Okta Integration Network (OIN), enabling Requesting Apps to refer to it when requesting ID-JAGs.
    • The Auth0 client_id that maps to each Requesting App in the OIN.
To get the issuer URL and the client ID within your Auth0 tenant, navigate to Applications, select your application, and select Settings:

​
Log in to the Requesting App

Log in to your Requesting App directly with your Okta tenant. When the login completes, your Requesting App receives an Okta ID token representing the authenticated user.

​
Exchange the ID token for an ID-JAG

The Requesting App makes a token exchange request to the /token endpoint of your Okta test tenant to exchange the Okta ID token for an ID-JAG:
XAA Beta does not support passing scopes to Okta’s /token endpoint. Set the required scopes in the next request to the Resource App’s Auth0 tenant /token endpoint. In a production environment, the Requesting App makes this request to the /token endpoint of your customer’s Okta tenant.

​
Send the ID-JAG to Auth0’s /token endpoint

Once the Requesting App receives an ID-JAG from Okta, it sends an access token request to the /token endpoint of the Resource App’s Auth0 tenant:
After the Resource App’s Auth0 Authorization Server validates the ID-JAG and verifies the user’s identity, it issues an access token scoped to the target API audience. The access token includes any scopes allowed by RBAC and other policies in the Resource App’s Auth0 tenant. The Auth0 Authorization Server does not issue refresh tokens in response to ID-JAG token exchanges. As a result, the Requesting App needs to get a new ID-JAG from the enterprise IdP, and undergo the applicable access controls, to get a new access token via XAA.

​
Further reading