> ## Documentation Index
> Fetch the complete documentation index at: https://auth0-feat-xaa-requesting-app.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> Set up and register the Requesting App for Cross App Access (XAA).

# Set up Requesting App

export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => {
  const stageTextMap = {
    "beta": "Beta",
    "ea": "Early Access"
  };
  const stageText = stageTextMap[stage] || "a product release stage";
  const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages";
  const linkify = (text, url) => {
    return <a href={url} target="_blank" rel="noreferrer" class="link">{text}</a>;
  };
  const includeDetails = (plans, contact, terms) => {
    const hasDetails = terms || plans || contact;
    if (!hasDetails) return null;
    return <span data-as="p">
            {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. </>}
            {contact && "To participate, contact " + contact + ". "}
            {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.</>}
        </span>;
  };
  return <Warning>
            <span data-as="p">
                <strong>The {feature} feature is in {linkify(stageText, prsLink)}.</strong>
            </span>

            {includeDetails(plans, contact, terms)}
        </Warning>;
};

<ReleaseStageNotice feature="Cross App Access (XAA)" stage="beta" contact="Auth0 Support" terms="true" />

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  This guide assumes you use Okta as your enterprise identity provider (IdP) and have administrative access to an Okta tenant for testing. If you don't have one, read [Create and configure your Okta tenant](/docs/secure/call-apis-on-users-behalf/xaa/idp/okta-as-oidc-idp#create-and-configure-your-okta-tenant).
</Callout>

This section explains how to set up the Requesting App for Cross App Access (XAA). The Requesting App and Resource App are connected using an OIDC connection pointing to the Resource App’s Auth0 tenant. The Requesting App uses the OIDC connection to make a token exchange request via the Token Vault to obtain an access token to call the API of the Resource App. For the Resource App setup, read [Set up Resource App](/docs/secure/call-apis-on-users-behalf/xaa/idp/okta-as-oidc-idp).

To set up your Requesting App tenant, you need to:

1. [Create the Requesting App in Auth0](#create-the-requesting-app-in-auth0): Create a confidental client in Auth0 and enable XAA for it.
2. [Create the Okta Workforce Enterprise connection](#create-the-okta-workforce-enterprise-connection): Federate with Okta as the enterprise IdP so your users can sign in with their Okta credentials.
3. [Register the Requesting App in Okta](#register-the-requesting-app-in-okta): Register the confidental client in the Okta Integration Network (OIN).
4. [Test the Okta Workforce Connection](#test-the-okta-workforce-connection): Authenticate a test user using the Okta Workforce Connection in the Auth0 Dashboard.
5. [Create the Resource App OIDC connection](#create-the-resource-app-oidc-connection): Create and register a connection that points to the Resource App's Auth0 tenant and enable Token Vault and XAA on it.

## Prerequisites

Before getting started, configure your Okta tenant for Cross App Access:

* On the [Okta Developer website](https://developer.okta.com/signup/), sign up for an Okta Integrator Free Plan.
* To enable Cross App Access, email `developers@okta.com` to request XAA enablement for your Okta tenant. Once approved, the Okta team can provide links to any available XAA Requesting and Resource Apps.

You also need access to a Resource App Auth0 tenant. To set one up, read [Set Up Resource App](/docs/secure/call-apis-on-users-behalf/xaa/idp/okta-as-oidc-idp). From the Resource App tenant, you need:

* The Resource App tenant's issuer URL. For example, `https://<RESOURCE_APP_TENANT>.auth0.com/`
* A Client ID and Client Secret for the Requesting App

## Create the Requesting App in Auth0

Create an application in your Requesting App Auth0 tenant representing the Requesting App. This must be a confidential client that can store a client secret, such as a Regular Web Application.

In the Auth0 Dashboard:

1. Navigate to **Applications > Applications** and select **Create Application**.
2. Enter a name (for example, `Agent0`) and select **Regular Web Application**.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/auth0-feat-xaa-requesting-app/docs/images/xaa/xaa_create_regular_web_app.png" alt="" />
</Frame>

3. Open the application's **Settings** and enable the **Cross App Access** toggle.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/auth0-feat-xaa-requesting-app/docs/images/xaa/allow_xaa_auth0_app.png" alt="" />
</Frame>

4. Navigate to **Advanced Settings > Grant Types** and make sure the **Authorization Code**, **Refresh Token**, and **Token Vault** grant types are enabled.

Note the application's Client ID; you will need it when registering the Requesting App in Okta.

## Create the Okta Workforce Enterprise connection

Create an Okta Workforce Enterprise connection in your Requesting App Auth0 tenant so your users can sign in using their Okta credentials. This connection also enables Auth0 to store Okta tokens in Token Vault during login.

To [create an Okta Workforce Enterprise connection](/docs/authenticate/identity-providers/okta), use the Okta application credentials for your Requesting App.

Once the connection is created, configure it for XAA:

1. Navigate to **Authentication > Enterprise > Okta Workforce** and select the connection.
2. Under **Settings**, add `offline_access` to the list of **Scopes** so the connection requests a refresh token from Okta.
3. Under **Settings > User Mapping**, select the **Okta Basic** template.
4. In the `userinfo_scope` property, add the `offline_access` scope so Token Vault can store a refresh token:

```json theme={null}
{
  "attributes": {
    "name": "${context.tokenset.name}",
    "email": "${context.tokenset.email}",
    "username": "${context.tokenset.preferred_username}",
    "federated_groups": "${context.userinfo.groups}",
    "federated_locale": "${context.userinfo.locale}",
    "federated_zoneinfo": "${context.userinfo.zoneinfo}"
  },
  "mapping_mode": "use_map",
  "userinfo_scope": "openid email profile groups offline_access"
}
```

5. Enable the **Cross App Access - Requesting Application** role for this connection using the Auth0 Dashboard or Management API:

<Tabs>
  <Tab title="Auth0 Dashboard">
    Under **Cross App Access Roles**, toggle on **Requesting Application**. This enables your Requesting App to request ID-JAGs issued by the enterprise IdP associated with this connection.
  </Tab>

  <Tab title="Management API">
    Make a `PATCH` request to the [`/connections/{YOUR_CONNECTION_ID}`](/docs/api/management/v2/connections/patch-connections-by-id) endpoint and set `cross_app_access_requesting_app` to `active: true`:

    ```bash theme={null}
    curl -L -X PATCH 'https://<YOUR_DOMAIN>/api/v2/connections/<YOUR_CONNECTION_ID>' \
      -H 'Content-Type: application/json' \
      -H 'Authorization: Bearer <YOUR_MANAGEMENT_API_TOKEN>' \
      -d '{"cross_app_access_requesting_app": {"active": true}}'
    ```
  </Tab>
</Tabs>

## Register the Requesting App in Okta

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  In a production environment, the Requesting App developer registers the Requesting App in the Okta Integration Network (OIN). Enterprise customers install it from the OIN catalog during their IdP setup.
</Callout>

The Requesting App must be registered in the Okta Integration Network (OIN) to be considered a valid XAA Requesting App.

To register a new application in the OIN, read [Submission process for SSO and SCIM integrations](https://developer.okta.com/docs/guides/submit-app-overview/). Contact your Auth0 or Okta representative to accelerate this process.

After adding the integration, configure the application's sign-on policy:

1. In the Okta Admin Console, go to **Applications > Applications** and select the Requesting App.
2. Under **Sign On**, select **Edit** and add your Okta Workforce connection's **callback URL** in the **Redirect URI** field.
3. Select **Save**.

Finally, assign your test user to the Requesting App:

1. Select **Assignments > Assign > Assign to People** and select your test user.
2. Select **Save**.

## Test the Okta Workforce connection

In the Auth0 Dashboard:

1. Navigate to **Authentication > Enterprise > Okta Workforce** and select the connection.
2. Select the **Applications** tab and enable the Requesting App you created.
3. Go back to the connections list, select the three dots next to your connection, and select **Try**. You will be redirected to authenticate with your Okta tenant.

## Create the Resource App OIDC connection

The Requesting App needs a connection in its Auth0 tenant that points to the Resource App's Auth0 tenant. This is how Token Vault knows which Resource App to target when exchanging tokens, and it is where you enable the XAA Resource App role on the Requesting App side.

Use the Client ID and Client Secret that the Resource App tenant issued for your Requesting App to create an OIDC Enterprise connection in your Requesting App Auth0 tenant.

To configure the connection for XAA:

1. For **Purpose**, select **Connected Accounts for Token Vault**.
2. For the **OpenID Connect Discovery URL**, enter the discovery URL of the Resource App's Auth0 tenant: `https://<RESOURCE_APP_TENANT>.auth0.com/.well-known/openid-configuration`.
3. Enable the **Cross App Access Delegation** toggle to authorize Token Vault to issue access tokens for third-party resource applications, including Cross App Access.
4. Enable the **Cross App Access - Resource Application** role using the Auth0 Dashboard or Management API:

<Tabs>
  <Tab title="Auth0 Dashboard">
    Toggle on **Enable Cross App Access Delegation**, then toggle on **Cross App Access - Resource Application**. This enables the connection to accept ID-JAGs targeting the Resource App's Auth0 tenant.
  </Tab>

  <Tab title="Management API">
    Make a `PATCH` request to the [`/connections/{YOUR_CONNECTION_ID}`](/docs/api/management/v2/connections/patch-connections-by-id) endpoint and set `connected_accounts` with `cross_app_access: true`:

    ```bash theme={null}
    curl -L -X PATCH 'https://<YOUR_DOMAIN>/api/v2/connections/<YOUR_CONNECTION_ID>' \
      -H 'Content-Type: application/json' \
      -H 'Authorization: Bearer <YOUR_MANAGEMENT_API_TOKEN>' \
      -d '{"connected_accounts": {"active": true, "cross_app_access": true}}'
    ```
  </Tab>
</Tabs>

Once the connection is created, you are ready to test the end-to-end XAA flow. To learn more, read [Test Cross App Access (XAA) Flow](/docs/secure/call-apis-on-users-behalf/xaa/end-to-end-testing).