---
title: "Build a Secure C# MCP App with Cross App Access (XAA)"
description: "Cross App Access (XAA) addresses the gap between a user’s authenticated identity and a downstream MCP server, API, or agent tool that must trust that identity without another login. The described flow uses OIDC and PKCE for sign-in, then RFC 8693 token exchange to turn the ID token into a JWT Authorization Grant (JAG), followed by RFC 7523 exchange at the MCP authorization server for a scoped bearer token. A C# MCP SDK IdentityAssertionGrantProvider encapsulates both exchanges, while ASP.NET Core OIDC middleware persists the ID token and an HTTP transport presents the resulting token to the MCP server. The sample connects to a Todo resource through the xaa.dev playground, completes MCP initialization, lists resources, and reads todo0://todos; the article states that the end-to-end implementation fits in under 50 lines of C#."
---

# Build a Secure C# MCP App with Cross App Access (XAA)

[Okta](https://yomu.fyi/company/okta) · Aasawari Sahasrabuddhe · Jul 16, 2026

**Type:** Tutorial

## Summary

Cross App Access (XAA) addresses the gap between a user’s authenticated identity and a downstream MCP server, API, or agent tool that must trust that identity without another login. The described flow uses OIDC and PKCE for sign-in, then RFC 8693 token exchange to turn the ID token into a JWT Authorization Grant (JAG), followed by RFC 7523 exchange at the MCP authorization server for a scoped bearer token. A C# MCP SDK IdentityAssertionGrantProvider encapsulates both exchanges, while ASP.NET Core OIDC middleware persists the ID token and an HTTP transport presents the resulting token to the MCP server. The sample connects to a Todo resource through the xaa.dev playground, completes MCP initialization, lists resources, and reads todo0://todos; the article states that the end-to-end implementation fits in under 50 lines of C#.

## Context

Single sign-on authenticates the user, but an ID Token issued for the requesting application does not by itself give a downstream MCP server, API, or agent tool a trusted representation of that user. XAA is presented as a way to extend that trust under enterprise policy without requiring the user to sign in again.

## Approach / What changed

Configure ASP.NET Core OIDC with PKCE, then use the C# MCP SDK’s IdentityAssertionGrantProvider to perform the two-hop exchange: present the user’s ID Token to the identity provider for an ID-JAG, exchange the ID-JAG at the MCP authorization server for a scoped access token, and attach that token to an HTTP MCP transport. The sample is registered and tested through the xaa.dev playground.

## Takeaways

- XAA uses RFC 8693 to obtain a JWT Authorization Grant from the enterprise identity provider and RFC 7523 to exchange that grant for a scoped MCP access token.
- Setting MapInboundClaims to false prevents ASP.NET Core from remapping standard OIDC claim names to legacy WS-Federation names.
- McpClient.CreateAsync performs the MCP initialization handshake before the sample lists resources and reads todo0://todos from the Todo resource server.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Developer Experience](https://yomu.fyi/topic/developer-experience), [Testing](https://yomu.fyi/topic/testing)

- Source: [Okta](https://developer.okta.com/blog/2026/07/16/csharp-mcp-cross-app-access)
- Source URL: https://developer.okta.com/blog/2026/07/16/csharp-mcp-cross-app-access
- Ingested by Yomu: 2026-08-27T14:56:25.906Z

[Read original post](https://developer.okta.com/blog/2026/07/16/csharp-mcp-cross-app-access)