feat: adding token vault with xaa page - #1728
Open
d4nt wants to merge 7 commits into
Open
Conversation
d4nt
marked this pull request as ready for review
August 19, 2026 07:40
tsviatkov
reviewed
Aug 20, 2026
Comment on lines
+83
to
+101
| { | ||
| "cross_app_access_requesting_app": { "active": true }, | ||
| "options": { | ||
| "scope": "openid profile email offline_access" | ||
| }, | ||
| "type": "back_channel", | ||
| "attribute_map": { | ||
| "attributes": { | ||
| "name": "${context.tokenset.name}", | ||
| "email": "${context.tokenset.email}", | ||
| "username": "${context.tokenset.preferred_username}", | ||
| "federated_groups": "${context.userinfo.groups}", | ||
| "federated_locale": "${context.userinfo.locale}", | ||
| "federated_zoneinfo": "${context.userinfo.zoneinfo}" | ||
| }, | ||
| "mapping_mode": "use_map", | ||
| "userinfo_scope": "openid email profile groups offline_access" | ||
| } | ||
| } |
Contributor
There was a problem hiding this comment.
I think this request is not totally correct, the body should be something like that:
{
"cross_app_access_requesting_app": {
"active": true
},
"options": {
"scope": "openid profile email offline_access",
"type": "back_channel",
"client_secret": "...",
"client_id": "...",
"attribute_map": {
"mapping_mode": "use_map",
"userinfo_scope": "openid email profile groups offline_access",
"attributes": {
"name": "${context.tokenset.name}",
"email": "${context.tokenset.email}",
"username": "${context.tokenset.preferred_username}",
"federated_groups": "${context.userinfo.groups}",
"federated_locale": "${context.userinfo.locale}",
"federated_zoneinfo": "${context.userinfo.zoneinfo}"
}
}
}
}
|
|
||
| Both Okta and OIDC connection types can be configured to act as XAA Requesting Applications. To | ||
| enable, open the Connection details in the management dashboard, scroll down to the Cross App | ||
| Access section and turn on the *Requesting Application* toggle. |
Contributor
There was a problem hiding this comment.
I think 1.c and 1.a should be switched between each other, because the "requesting application" toggle is disabled when communication channel is "front channel"
| for details). | ||
| 3. The third-party API being accessed must support XAA as a "Resource App", meaning it can exchange | ||
| an `ID-JAG` for access tokens. Third-party applications that are also using Auth0 can enable this | ||
| feature; read [Cross App Access (XAA)](/docs/secure/call-apis-on-users-behalf/xaa) for details. |
Contributor
There was a problem hiding this comment.
Suggested change
| feature; read [Cross App Access (XAA)](/docs/secure/call-apis-on-users-behalf/xaa) for details. | |
| feature; read [Cross App Access (XAA)](/docs/ai-agents-mcp/cross-app-access) for details. |
tsviatkov
approved these changes
Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR adds a new guide to the Token Vault section "Configuring Token Vault with XAA". It walks the customer through setting up Token Vault to use the XAA Requesting App flow to request access tokens from Resource App APIs.
References
https://auth0team.atlassian.net/browse/FGI-2436
Testing
Checklist
CONTRIBUTING.md.