Cross-App Access (XAA) is an identity and authorization framework introduced by Okta that lets users authenticate once through their enterprise identity provider (IdP), and then securely access resources across connected applications without repeatedly authorizing each application.
For Zoom app developers, XAA enables you to build integrations that let users access Zoom resources through your application while leveraging their organization's single sign-on (SSO) and multifactor authentication (MFA) policies. This simplifies app installation and management, particularly for AI agents (such as Claude and ChatGPT accessing Zoom meetings) and workflow automation tools (such as Figma, Linear, and Asana connecting to Zoom).
For technical details on XAA concepts and implementation, see Okta's Cross App Access documentation .
Token exchange flow
Token exchange is the core mechanism that enables XAA. This is an overview of a token exchange flow.
- The user signs in and authenticates with the requesting app through their enterprise IdP (e.g., Okta).
- The IdP issues an ID token containing the user's identity claims to the requesting app.
- The requesting app sends the ID token to the IdP's token endpoint.
- The IdP validates the ID token and returns an ID-JAG (Identity Assertion JWT Authorization Grant) to the requesting app.
- The requesting app sends the ID-JAG to the resource app's authorization server.
- The resource app's authorization server validates the ID-JAG and issues an access token back to requesting app.
- The requesting app uses the access token to call the resource app's APIs on behalf of the user.
This exchange happens server-to-server without requiring additional user interaction, creating a seamless cross-app experience.
Zoom XAA support
Zoom supports both requesting app and resource app implementation.
- Requesting App: The application that requests access to resources on behalf of the user. For example, if you build an AI agent that needs to access Zoom meetings, your AI agent is the requesting app.
- Resource App: The application or API being accessed that provides protected resources. For example, when your application calls Zoom APIs to access meeting data, Zoom is the resource app.
Use the same enterprise IdP instance
Both Zoom and your application must use the same enterprise IdP instance (e.g., the same Okta organization) for XAA to work.
Building a requesting app with Zoom
To build an application, with Zoom acting as the requesting app, to access resources from third-party resources service, you need to configure a connector first.
Contact Zoom Developer Support to enable XAA
We currently do not support self-service configuration. Contact Zoom support or post in the Zoom Developer Forum to request they enable XAA for your connector configuration.
Building a resource app calling Zoom
To build an application to access Zoom resources on behalf of users, with Zoom is the resource app, ensure your app handles the following:
- Obtain an ID Token — After the user authenticates with their enterprise IdP (Okta, Auth0, etc.), your application receives an ID token containing the user's identity claims.
- Exchange the ID Token for a Zoom Access Token — Send the ID token to Zoom's token endpoint (
https://zoom.us/oauth/token) to exchange it for a Zoom access token. The IdP will have already issued the ID-JAG with the necessary claims; you simply pass it to Zoom. - Call Zoom APIs — Use the access token returned by Zoom to make API calls on behalf of the user.
User authentication environment requirements
- Enterprise IdP Account: Your customers must have an enterprise IdP account (e.g., Okta, Auth0).
- SSO Configuration: Your customers' Zoom accounts must have Single Sign-On configured using either SAML or OIDC with their IdP.
For Zoom XAA configuration information for IT admins, see Configuring Cross App Access .
Regional Zoom API endpoints
XAA supports Zoom's regional API endpoints. You are not limited to api.zoom.us and can use region-specific endpoints as needed.
For implementation guidance, see: