# Develop a XAA-Enabled Resource Application and Test with Okta

**URL:** <https://devforum.okta.com/t/develop-a-xaa-enabled-resource-application-and-test-with-okta/35060>\
**Category:** Developer Blog Comments\
**Created:** [February 18, 2026, 12:41am UTC](https://devforum.okta.com/t/develop-a-xaa-enabled-resource-application-and-test-with-okta/35060 "2026-02-18T00:41:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\
**Post date:** [February 18, 2026, 12:41am UTC](https://devforum.okta.com/t/develop-a-xaa-enabled-resource-application-and-test-with-okta/35060/1 "2026-02-18T00:41:46Z")

</div>

From an enterprise resource app owner’s perspective, Cross App Access (XAA) is a game-changer because it allows their resources to be “AI-ready” without compromising on security. In the XAA model, resource apps rely on the enterprise’s Identity Provider (IdP) to manage access. Instead of building out interactive OAuth flows, they defer to the IdP to check enterprise policies and user groups, assign AI agent permissions, and log and audit AI agent requests as they occur. In return, the app’s OAuth server needs only to perform a few checks:

* * *
This is a companion discussion topic for the original entry at [https://developer.okta.com/blog/2026/02/17/xaa-resource-app](https://developer.okta.com/blog/2026/02/17/xaa-resource-app)

---

<div class="post-metadata">

**Author:** ![alisaduncan](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/alisaduncan/32/3429_2.png) [@alisaduncan](https://devforum.okta.com/u/alisaduncan)\
**Post date:** [September 22, 2026, 3:19pm UTC](https://devforum.okta.com/t/develop-a-xaa-enabled-resource-application-and-test-with-okta/35060/2 "2026-09-22T15:19:18Z")

</div>

Great post! What a gamechanger.

---

<div class="post-metadata">

**Author:** ![oktadev-blog](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/oktadev-blog/32/3422_2.png) [@oktadev-blog](https://devforum.okta.com/u/oktadev-blog)\
**Post date:** [September 22, 2026, 3:19pm UTC](https://devforum.okta.com/t/develop-a-xaa-enabled-resource-application-and-test-with-okta/35060/3 "2026-09-22T15:19:18Z")

</div>


