Skip to main content
By configuring your Auth0 tenant as the Requesting App, your AI agent or SaaS application can call third-party APIs on a user’s behalf without requiring the user to go through OAuth consent flows. The enterprise IT admin defines and manages the access policy in their identity provider (IdP). When a user logs into your application through their enterprise IdP, your Auth0 tenant acts as the Requesting App: it obtains an ID-JAG from the enterprise IdP and exchanges it for an access token from the Resource App. Your application uses that access token to call the Resource App’s API. Auth0 then stores and reuses the tokens your application retrieves via XAA in Token Vault.

​
Get started

If you want to set up and test the full XAA flow from the Requesting App side:
  1. Complete Environment Setup to configure your test Resource App and the OIDC connection between your Auth0 tenant and the Resource App tenant.
  2. Configure the enterprise IdP by following the applicable guide in IdP Integration: Okta as OIDC IdP.
  3. Configure Token Vault with Cross App Access to store and reuse the tokens your application retrieves via XAA.
If you’ve already set up Token Vault and want to add XAA support, read Cross App Access with Token Vault.