Loading…
Topic
Cross App Access
6 posts about Cross App Access. Every summary links to the original.
- 6 posts
- 2 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Build a Secure TypeScript MCP Client with Cross App Access (XAA)
The post presents a tutorial for building a TypeScript Model Context Protocol (MCP) client that uses Cross App Access (XAA) to securely bridge enterprise apps across trust domains. The sample app is an employee onboarding dashboard that signs in through an identity provider, exchanges identity for an Identity Assertion JWT Authorization Grant (ID-JAG), trades it for an access token, and fetches data from a protected MCP server. The tutorial uses the MCP TypeScript SDK’s CrossAppAccessProvider to automate the four-step XAA flow, including token exchange and retry on 401 responses. Developers test against xaa.dev, a free playground that hosts the IdP, authorization server, and a todo MCP server. The post explains key concepts like ID-JAG claims, separate client credentials per trust domain, and how XAA enables AI agents and enterprise apps to act on behalf of users without OAuth consent screens.
How to Make Your AI Agent Enterprise-Ready: Enabling Enterprise-Managed Authorization for Client Apps in Auth0
Auth0 is launching Early Access for Client App, or Requesting App, capabilities that support Cross App Access (XAA) for AI assistants, developer tools, and autonomous agents. In the Enterprise-Managed Authorization (EMA) model, an employee’s corporate SSO login can authorize access to external APIs or Model Context Protocol (MCP) servers through the IETF Identity Assertion Authorization Grant (ID-JAG) draft specification. Auth0’s Token Vault brokers the multi-hop exchange: it stores an upstream enterprise refresh token, retrieves a short-lived ID-JAG, exchanges it with the downstream Resource App, and returns a standard access token to the backend. Setup uses dashboard toggles and connection settings, followed by a standard /oauth/token federated exchange, while the API requires no XAA-specific changes. The release also describes audit logging, enterprise IdP policy control, OIN distribution, and caching downstream tokens because ID-JAG exchanges are rate-limited to 50% of the tier’s standard Auth API limit.
Okta Developer Connect San Francisco 2026 Recap
Okta Developer Connect San Francisco brought more than 100 developers, architects, founders, platform engineers, and security leaders to Okta HQ for technical sessions, hands-on labs, and community conversations about securing identity in the age of AI. The keynote announced general availability of Okta for AI Agents, which provides discovery, shadow AI detection, short-lived credentials, scoped tokens, vaulted secrets, MCP server controls, lifecycle governance, SIEM audit logs, and a kill switch. Sessions examined Cross App Access, using identity assertion and token exchange across a requesting app, identity provider, and resource app, plus Auth0-based patterns including Token Vault, asynchronous authorization, and fine-grained access control. Discussions described agents outpacing governance, static credentials creating risk, and RAG pipelines requiring data-layer permissions that match user access. The event concluded that builders should treat agents as identities with ownership, scope, review, consent, and revocation designed before integrations go live.
Make Secure App-to-App Connections Using Cross App Access
Enterprise app-to-app integrations can create governance, security, and consent problems when API keys lack user context and standard OAuth leaves connection approval to individuals. The tutorial adds Cross App Access (XAA), an OAuth extension based on the Identity Assertion Authorization Grant, to a NestJS note-taking app and connects it to a to-do app through xaa.dev. It uses TypeScript, openid-client, and the testing site’s IdP, with two token exchanges: an ID token becomes an ID-JAG token, then a JWT-bearer grant exchanges that assertion at the resource authorization server for an access token. After authentication, the completed flow calls the to-do API and exposes each handshake step and response in console logs.
Introducing xaa.dev: A Playground for Cross App Access
xaa.dev is a free, beta playground for exploring Cross App Access (XAA) end to end without local setup, infrastructure provisioning, or signup. It addresses the difficulty of testing XAA, which otherwise requires configuring an Identity Provider, resource authorization server, resource API, and requesting application before a token exchange can be observed. The site pre-configures these roles and guides users through authentication, token exchange, access token request, and resource access while exposing requests, responses, and cryptographic claims. Developers can also connect their own apps, including MCP clients, and test both OIDC and SAML identity assertions; it is currently in beta and requires no account.
Integrate Your Enterprise AI Tools with Cross App Access (XAA)
Enterprise AI tools increasingly use protocols such as Model Context Protocol (MCP) to request data and resources from work applications, creating identity and authorization challenges that ordinary app-to-app consent does not expose to enterprise administrators. Cross App Access (XAA) places the enterprise identity provider between the requesting application and resource application by combining OAuth Token Exchange (RFC 8693), JWT Profile for Authorization Grants (RFC 7523), and the Identity Assertion Authorization Grant profile. In the illustrated flow, a user signs in to Agent0, the IdP issues an ID token, and Agent0 exchanges it for an ID-JAG targeted at Todo0’s authorization server. Todo0 validates that assertion and returns its normal access token, enabling MCP requests without interactive consent while allowing enterprise policy checks. The design leaves access-token format and validation with the resource application, while refresh-token behavior remains to be defined to balance policy enforcement and session continuity.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.