> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.com/llms.txt
> Use this file to discover all available pages before exploring further.

> Configure a test Resource App and the OIDC connection between your Requesting App tenant and the Resource App tenant for Cross App Access.

# XAA Environment Setup

export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => {
  const stageTextMap = {
    "beta": "Beta",
    "ea": "Early Access"
  };
  const stageText = stageTextMap[stage] || "a product release stage";
  const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages";
  const linkify = (text, url) => {
    return <a href={url} target="_blank" rel="noreferrer" class="link">{text}</a>;
  };
  const includeDetails = (plans, contact, terms) => {
    const hasDetails = terms || plans || contact;
    if (!hasDetails) return null;
    return <span data-as="p">
            {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. </>}
            {contact && "To participate, contact " + contact + ". "}
            {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.</>}
        </span>;
  };
  return <Warning>
            <span data-as="p">
                <strong>The {feature} feature is in {linkify(stageText, prsLink)}.</strong>
            </span>

            {includeDetails(plans, contact, terms)}
        </Warning>;
};

<ReleaseStageNotice feature="Cross App Access (XAA) for the Requesting App" stage="ea" plans="Enterprise, B2B Pro, and B2B Essential" terms="true" />

To test the end-to-end XAA flow from the Requesting App side, you need two Auth0 tenants:

* Requesting App tenant: Your Auth0 tenant, which acts as the Requesting App. Your AI agent or SaaS application is registered here.
* Resource App tenant: A separate Auth0 tenant acting as the Resource App Authorization Server. In production, this tenant belongs to the third-party SaaS provider whose API you want to call.

The environment setup covers:

1. [Configure the test Resource App](#configure-the-test-resource-app) in the Resource App tenant.
2. [Configure the OIDC connection](#configure-the-oidc-connection) between the Requesting App tenant and the Resource App tenant.

This article only covers the Auth0 environment setup. For the enterprise IdP-side configuration, read the applicable guide in IdP Integration: [Okta as OIDC IdP](/docs/ai-agents-mcp/cross-app-access/requesting-app/idp/okta-as-oidc-idp).

## Configure the test Resource App

The following steps configure a test Resource App and its API in the Resource App tenant. In production, the third-party SaaS provider completes these steps as part of their XAA Resource App setup.

### Create the Resource App

In the Resource App tenant, navigate to **Applications > Applications** and select **Create Application**. Enter a name and select **Regular Web Application**, **Native**, or **Single Page Application** depending on the type of application you want to use.

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/xaa/xaa_create_native_app.png" alt="" />
</Frame>

<Tabs>
  <Tab title="Auth0 Dashboard">
    1. Under **Application URIs**, add the callback URL of your Requesting App tenant as an **Allowed Callback URL**: `https://YOUR_REQUESTING_APP_DOMAIN/login/callback`.
    2. Under **Cross App Access**, enable **Allow Cross App Access**.

    <Frame>
      <img src="https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/xaa/allow_xaa_auth0_app.png" alt="" />
    </Frame>

    3. Under **Advanced Settings > Grant Types**, select **Authorization Code** and **Refresh Token**.
    4. Select **Save Changes**.
  </Tab>

  <Tab title="Management API">
    Make a `PATCH` call to the [Update a Client](https://auth0.com/docs/api/management/v2/clients/patch-clients-by-id) endpoint to add the required grant types, enable Cross App Access, and set the allowed callback URL:

    ```bash theme={null}
    curl --request PATCH 'https://{yourResourceAppDomain}/api/v2/clients/{clientId}' \
      --header 'Content-Type: application/json' \
      --header 'Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>' \
      --data '{
        "callbacks": ["https://YOUR_REQUESTING_APP_DOMAIN/login/callback"],
        "cross_app_access": { "active": true },
        "grant_types": [
          "authorization_code",
          "refresh_token"
        ]
      }'
    ```
  </Tab>
</Tabs>

Note the Client ID and Client Secret of the Resource App. You'll need these when configuring the OIDC connection in your Requesting App tenant. For applications registered using the [Client ID Metadata Document (CIMD)](/docs/get-started/auth0-overview/create-applications/register-applications-with-cimd), use the External Client ID field for the Client ID.

### Create the Resource App API

In the Resource App tenant, navigate to **Applications > APIs** and select **Create API**.

1. Enter a name and an identifier for the API. The identifier cannot be changed after creation.
2. Under **Access Settings**, select **Allow Offline Access**.
3. Under **Access Policy for Applications**, select **All apps allowed** or configure per-app authorization as needed for user-delegated and client access.
4. Set the API identifier as the **Default Audience** for the Resource App tenant under [Tenant Settings](/docs/get-started/tenant-settings).
5. Select **Create**.

## Configure the OIDC connection

In your Requesting App tenant, create an OIDC Enterprise connection that federates your tenant with the Resource App tenant. This connection enables your tenant, which acts as the Requesting App, to obtain ID-JAGs from the enterprise IdP and exchange them for access tokens from the Resource App.

<Tabs>
  <Tab title="Auth0 Dashboard">
    1. Navigate to **Authentication > Enterprise > OpenID Connect** and select **Create Connection**.

    Enter the following:

    | Field                  | Value                                                                                                              |
    | ---------------------- | ------------------------------------------------------------------------------------------------------------------ |
    | **Connection name**    | A unique name for the connection, such as `my-resource-app-oidc-connection`.                                       |
    | **OIDC Discovery URL** | The discovery URL of the Resource App tenant: `https://YOUR_RESOURCE_APP_DOMAIN/.well-known/openid-configuration`. |
    | **Client ID**          | The Client ID of the Resource App application in the Resource App tenant.                                          |
    | **Client Secret**      | The Client Secret of the Resource App application in the Resource App tenant.                                      |

    2. Under **Purpose**, select **Authentication and Connected Accounts for Token Vault** to allow this connection to be used for user login and secure token management with Token Vault.

    3. Under **Cross App Access**:
       * Under **Cross App Access Roles**, select **Requesting Application**.
       * Under **Cross App Access for Token Vault**, select **Enable Cross App Access for Token Vault** to authorize Token Vault to retrieve and store access tokens from the Resource App on the user's behalf.

    4. Select **Create**.
  </Tab>

  <Tab title="Management API">
    Make a `POST` call to the [Create a Connection](https://auth0.com/docs/api/management/v2/connections/post-connections) endpoint:

    ```bash theme={null}
    curl --request POST 'https://{yourDomain}/api/v2/connections' \
      --header 'Content-Type: application/json' \
      --header 'Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>' \
      --data '{
        "name": "my-resource-app-oidc-connection",
        "strategy": "oidc",
        "options": {
          "discovery_url": "https://YOUR_RESOURCE_APP_DOMAIN/.well-known/openid-configuration",
          "client_id": "<RESOURCE_APP_CLIENT_ID>",
          "client_secret": "<RESOURCE_APP_CLIENT_SECRET>",
          "scope": "openid profile email"
        },
        "metadata": {
          "purpose": "connected_accounts"
        },
        "cross_app_access_requesting_app": { "active": true },
        "connected_accounts": {
          "active": true,
          "cross_app_access": true
        }
      }'
    ```
  </Tab>
</Tabs>

## Next steps

Once you've configured the OIDC connection, proceed to configure the enterprise IdP: [Okta as OIDC IdP](/docs/ai-agents-mcp/cross-app-access/requesting-app/idp/okta-as-oidc-idp).