Overview

Cross App Access Token Limits in Okta Single Sign-On

Cross App Access and Agent Single Sign-On in Single Sign-On supports up to 250 ID-JAG tokens per user per Resource App per month. Usage resets monthly based on the applicable Order Form Start Date, and unused tokens do not accumulate. Higher token volumes require additional capacity.

Applies To

• Okta Identity Engine (OIE)

• Cross App Access

• Single Sign-On

• Access token limits

How does Okta measure Cross App Access token usage?

Okta limits Cross App Access in Single Sign-On to 250 ID-JAG access tokens per user per Resource App per month.

For this limit:

• A user must be a licensed user of Single Sign-On in an active status.

• The total number of users utilizing Cross App Access cannot exceed the total purchased Single Sign-On user quantity.

• A Resource App is an application accessed by a requesting application or an artificial intelligence (AI) agent acting on behalf of a user.

• One ID-JAG token is consumed each time an AI agent or an application uses Cross App Access to access a Resource App.

What defines the monthly reset period for Cross App Access?

Okta measures usage on a monthly basis beginning on the Start Date of the applicable Order Form.

The monthly allocation behaves as follows:

• The access token allocation resets at the beginning of each monthly period.

• Unused access tokens do not roll over or accumulate.

What happens when usage approaches the monthly token limit?

Cross App Access usage in Single Sign-On is subject to a soft cap on ID-JAG tokens. Customers approaching or exceeding 250 access tokens per user per Resource App per month will not be blocked during the current billing period. Customers requiring token volumes above the limit are encouraged to purchase additional capacity - see upgrade options below.

How can customers get higher token limits?

Customers requiring ID-JAG token volumes above the monthly limit are encouraged to purchase Okta for AI Agents for a platform-wide agentic identity security solution or contact the account team for more details.

Cross App Access Availability May Change

Cross App Access in Single Sign-On may be modified, moved, removed, or provided on a time-limited basis.