---
title: "Introducing xaa.dev: A Playground for Cross App Access"
description: "xaa.dev is a free, beta playground for exploring Cross App Access (XAA) end to end without local setup, infrastructure provisioning, or signup. It addresses the difficulty of testing XAA, which otherwise requires configuring an Identity Provider, resource authorization server, resource API, and requesting application before a token exchange can be observed. The site pre-configures these roles and guides users through authentication, token exchange, access token request, and resource access while exposing requests, responses, and cryptographic claims. Developers can also connect their own apps, including MCP clients, and test both OIDC and SAML identity assertions; it is currently in beta and requires no account."
---

# Introducing xaa.dev: A Playground for Cross App Access

[Okta](https://yomu.fyi/company/okta) · Sohail Pathan · Jan 20, 2026

**Type:** Announcement

## Summary

xaa.dev is a free, beta playground for exploring Cross App Access (XAA) end to end without local setup, infrastructure provisioning, or signup. It addresses the difficulty of testing XAA, which otherwise requires configuring an Identity Provider, resource authorization server, resource API, and requesting application before a token exchange can be observed. The site pre-configures these roles and guides users through authentication, token exchange, access token request, and resource access while exposing requests, responses, and cryptographic claims. Developers can also connect their own apps, including MCP clients, and test both OIDC and SAML identity assertions; it is currently in beta and requires no account.

## Context

Testing Cross App Access locally requires configuring an Identity Provider, a resource authorization server, the resource API, and a requesting application, creating a substantial barrier before developers can observe a token exchange.

## Approach / What changed

xaa.dev provides a free, pre-configured playground with Requesting App, Resource App, Identity Provider, and Resource MCP Server components. It guides users through the XAA flow, exposes requests and responses, and supports registering or connecting their own applications with OIDC or SAML identity assertions.

## Takeaways

- The playground demonstrates User Authentication, Token Exchange, Access Token Request, and Access Resource steps, with requests and responses available for inspection.
- A simulated Identity Provider mints ID-JAGs and exposes the cryptographic claims used in the Cross App Access flow.
- Developers can test traditional apps, APIs, and MCP clients, including implementations that use either OIDC or SAML identity assertions.

**Tags:** [Cross App Access](https://yomu.fyi/topic/cross-app-access), [MCP](https://yomu.fyi/topic/mcp), [OAuth2](https://yomu.fyi/topic/oauth2)

- Source: [Okta](https://developer.okta.com/blog/2026/01/20/xaa-dev-playground)
- Source URL: https://developer.okta.com/blog/2026/01/20/xaa-dev-playground
- Ingested by Yomu: 2026-09-09T08:43:24.596Z

[Read original post](https://developer.okta.com/blog/2026/01/20/xaa-dev-playground)