> ## Documentation Index
> Fetch the complete documentation index at: https://auth0-feat-xaa-requesting-app.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Learn how to test the end-to-end XAA flow.

# End-to-end Testing

export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => {
  const stageTextMap = {
    "beta": "Beta",
    "ea": "Early Access"
  };
  const stageText = stageTextMap[stage] || "a product release stage";
  const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages";
  const linkify = (text, url) => {
    return <a href={url} target="_blank" rel="noreferrer" class="link">{text}</a>;
  };
  const includeDetails = (plans, contact, terms) => {
    const hasDetails = terms || plans || contact;
    if (!hasDetails) return null;
    return <span data-as="p">
            {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. </>}
            {contact && "To participate, contact " + contact + ". "}
            {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.</>}
        </span>;
  };
  return <Warning>
            <span data-as="p">
                <strong>The {feature} feature is in {linkify(stageText, prsLink)}.</strong>
            </span>

            {includeDetails(plans, contact, terms)}
        </Warning>;
};

<ReleaseStageNotice feature="Cross App Access (XAA)" stage="beta" contact="Auth0 Support" terms="true" />

To test the end-to-end XAA flow, your Requesting App exchanges an ID token for an ID-JAG at the enterprise IdP, then presents that ID-JAG to the Resource App's authorization server for an access token.

Before testing, make sure you:

* Update the **Redirect URI** field to the callback URL of your testing application that acts as your Requesting App in your Okta tenant, as explained in [Register the Requesting App in Okta](/docs/secure/call-apis-on-users-behalf/xaa/idp/okta-as-oidc-idp#register-the-requesting-app-in-okta).
* Provide your Okta representative with the following information:
  * The issuer URL of your Auth0 tenant. Your Resource App is associated with the issuer URL in the Okta Integration Network (OIN), enabling Requesting Apps to refer to it when requesting ID-JAGs.
  * The Auth0 `client_id` that maps to each Requesting App in the OIN.

To get the issuer URL and the client ID within your Auth0 tenant, navigate to **Applications**, select your application, and select **Settings**:

| **Field**   | **Instructions**                                                             | **Example**                                                                                                      |
| ----------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| Issuer URL  | Copy your Auth0 domain, prefix it with `https://`, and add a trailing slash. | `https://tenant.region.auth0.com/` or if your customers are using a custom domain, `https://custom-domain.com/`. |
| `client_id` | Copy the application’s client ID.                                            | `ovBLQycaVq6I0Xyuhq84pwDVyJeXWLyx`                                                                               |

## Log in to the Requesting App

Log in to your Requesting App directly with your Okta tenant. When the login completes, your Requesting App receives an Okta ID token representing the authenticated user.

## Exchange the ID token for an ID-JAG

The Requesting App makes a [token exchange request](https://www.ietf.org/archive/id/draft-parecki-oauth-identity-assertion-authz-grant-05.html#name-token-exchange) to the `/token` endpoint of your Okta test tenant to exchange the Okta ID token for an ID-JAG:

```
POST /oauth2/v1/token HTTP/1.1
Host: <YOUR_OKTA_TENANT>.okta.com
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:token-exchange
&requested_token_type=urn:ietf:params:oauth:token-type:id-jag
&audience=<RESOURCE_APP_AUTH0_TENANT_ISSUER_URL>
&resource=<RESOURCE_APP_API_AUDIENCE>
&subject_token=<OKTA_ID_TOKEN>
&subject_token_type=urn:ietf:params:oauth:token-type:id_token
&client_id=<REQUESTING_APP_CLIENT_ID_IN_OKTA>
&client_secret=<REQUESTING_APP_CLIENT_SECRET_IN_OKTA>
```

| **Parameter**          | **Description**                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `grant_type`           | The token exchange grant type: `urn:ietf:params:oauth:grant-type:token-exchange`.                                                                                                                                                                                                                                                                                                                                                               |
| `requested_token_type` | The type of token to receive back. Set to the ID-JAG type: `urn:ietf:params:oauth:token-type:id-jag`.                                                                                                                                                                                                                                                                                                                                           |
| `audience`             | The issuer URL of the Resource App’s Auth0 tenant. Okta uses this to identify which Resource App the ID-JAG is intended for.                                                                                                                                                                                                                                                                                                                    |
| `resource`             | Optional. The Resource App’s API audience. Included in the ID-JAG’s `aud` claim, which the Resource App’s authorization server uses to validate the subsequent access token request. If you don’t specify a `resource` parameter, the Resource App tenant’s default audience is used. If you specify a value that does not match a valid API audience in the Resource App’s Auth0 tenant, the subsequent access token request will be rejected. |
| `subject_token`        | The Okta ID token obtained when the user authenticated. Okta uses this to verify the user’s identity and apply XAA policy.                                                                                                                                                                                                                                                                                                                      |
| `subject_token_type`   | The type of token in `subject_token`. Set to `urn:ietf:params:oauth:token-type:id_token`.                                                                                                                                                                                                                                                                                                                                                       |
| `client_id`            | The client ID of the Requesting App registered in Okta.                                                                                                                                                                                                                                                                                                                                                                                         |
| `client_secret`        | The client secret of the Requesting App registered in Okta.                                                                                                                                                                                                                                                                                                                                                                                     |

XAA Beta does not support passing scopes to Okta’s `/token` endpoint. Set the required scopes in the next request to the Resource App's Auth0 tenant `/token` endpoint.

In a production environment, the Requesting App makes this request to the `/token` endpoint of your customer’s Okta tenant.

## Send the ID-JAG to Auth0’s /token endpoint

Once the Requesting App receives an ID-JAG from Okta, it sends an [access token request](https://www.ietf.org/archive/id/draft-parecki-oauth-identity-assertion-authz-grant-05.html#name-access-token-request) to the `/token` endpoint of the Resource App’s Auth0 tenant:

```
POST https://<RESOURCE_APP_AUTH0_TENANT_DOMAIN>/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer
&client_id=<REQUESTING_APP_CLIENT_ID_IN_RESOURCE_APP_AUTH0_TENANT>
&client_secret=<REQUESTING_APP_CLIENT_SECRET_IN_RESOURCE_APP_AUTH0_TENANT>
&scope=scope1%20scope2
&assertion=<ID_JAG>
```

| **Parameter**   | **Description**                                                                                                                                     |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- |
| `grant_type`    | The JWT Bearer grant type: `urn:ietf:params:oauth:grant-type:jwt-bearer`. Tells the authorization server to expect a JWT as the primary credential. |
| `client_id`     | The client ID of the Requesting App registered in the Resource App’s Auth0 tenant.                                                                  |
| `client_secret` | The client secret of the Requesting App registered in the Resource App’s Auth0 tenant.                                                              |
| `scope`         | The permissions the Requesting App is requesting for the access token.                                                                              |
| `assertion`     | The ID-JAG JWT returned by Okta in the previous step.                                                                                               |

After the Resource App’s Auth0 Authorization Server validates the ID-JAG and verifies the user’s identity, it issues an access token scoped to the target API audience. The access token includes any scopes allowed by RBAC and other policies in the Resource App’s Auth0 tenant.

The Auth0 Authorization Server does not issue refresh tokens in response to ID-JAG token exchanges. As a result, the Requesting App needs to get a new ID-JAG from the enterprise IdP, and undergo the applicable access controls, to get a new access token via XAA.

## Further reading

* [Auth0 Cross App Access Inspector](https://github.com/auth0-samples/auth0-cross-app-access-inspector): A simple Node.js application for testing the XAA flow between Okta and Auth0.
* [XAA.dev](https://xaa.dev/): An online sandbox for testing Cross App Access in your browser.