Request access from another organization.
Organization B can exchange a token from organization A for a token that B’s application programming interface (API) accepts. B decides which identities, resources, and permissions it will allow.
Why this lesson?
A partner organization accepts some user requests from your organization. It issues its own access token only when its local rules allow the exchange.
Learning goal and prerequisites
Present a token from A
The caller presents a subject token issued by A. B has explicitly configured which A tokens it accepts for this exchange. B verifies the token and connects its external subject to local policy. Downloading A’s public keys alone would not establish this agreement.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Organizations sometimes need to let users or services from one administrative domain access resources in another. Simply sharing passwords, client secrets, or broad tokens across that boundary makes ownership and revocation difficult. Cross-domain OAuth uses explicit trust and token issuance instead.
The resource-owning organization decides which external issuers, clients, identities, and permissions it will trust. A caller presents an acceptable token or authorization context, and the remote authorization system evaluates that evidence under its own policy. If the request is allowed, it issues a token intended for the remote application programming interface (API).
This is useful because organization B does not have to treat every token from organization A as locally valid. B can translate the external identity into a local decision and issue a credential with B’s own audience, lifetime, and permissions.
The receiving API still validates the token it receives. Trust in the external organization is not automatic trust in every external user or scope. Cross-domain access therefore depends on explicit issuer trust, resource and audience restrictions, mapping rules, and a way to remove that trust when the partnership ends.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.