# cross-app-access

Cross-App Access (XAA) is an OAuth extension that enables an enterprise identity provider to manage connections between applications and broker cross-domain API access.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents

DevFeed: [Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents](<https://devfeed.tech/articles/okta-cross-app-access-xaa-id-jag-in-nirmata-aicontrols-standards-based-authorization-for-ai-agents-17657.md>)

Original publisher: [Read original article](<https://nirmata.com/2026/08/18/okta-cross-app-access-xaa-id-jag/>)

Author: Ritesh Patel

Published: 2026-08-19T00:24:40Z

Content type: article

Language: en

Sources: [Nirmata](<https://devfeed.tech/sources/nirmata.md>)

Topics: [cross-app-access](<https://devfeed.tech/topics/cross-app-access.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [okta](<https://devfeed.tech/topics/okta.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Model Context Protocol (MCP)](<https://devfeed.tech/topics/model-context-protocol-mcp.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [cross-app-access](<https://devfeed.tech/tags/cross-app-access.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [llm](<https://devfeed.tech/tags/llm.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [okta](<https://devfeed.tech/tags/okta.md>), [standards](<https://devfeed.tech/tags/standards.md>)

### AI overview

The article explains how Nirmata AIControls supports Okta Cross App Access and the ID-JAG authorization profile for AI agents. It describes token exchanges performed on behalf of agents, administrator-controlled app-to-app access, policy checks, budgets, and audit records for delegated MCP and LLM calls.

### Source excerpt

AIControls now performs the ID-JAG token exchanges on your agents' behalf -- so agents need no protocol code -- and policy-checks, budgets, and attributes every delegated MCP and LLM call to the human it acts for. ID-JAG answers may this agent act for this user? AIControls answers what... The post Okta Cross App Access (XAA / ID-JAG) in Nirmata AIControls: standards-based authorization for AI agents first appeared on Nirmata.

## Build a Secure C# MCP App with Cross App Access (XAA)

DevFeed: [Build a Secure C# MCP App with Cross App Access (XAA)](<https://devfeed.tech/articles/build-a-secure-c-mcp-app-with-cross-app-access-xaa-15971.md>)

Original publisher: [Read original article](<https://developer.okta.com/blog/2026/07/16/csharp-mcp-cross-app-access>)

Author: Aasawari Sahasrabuddhe

Published: 2026-07-16T05:00:00Z

Content type: tutorial

Language: en

Sources: [Okta Developer](<https://devfeed.tech/sources/okta-developer.md>)

Topics: [cross-app-access](<https://devfeed.tech/topics/cross-app-access.md>), [Model Context Protocol (MCP)](<https://devfeed.tech/topics/model-context-protocol-mcp.md>), [C#](<https://devfeed.tech/topics/csharp.md>), [SDKs](<https://devfeed.tech/topics/sdks.md>), [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [API](<https://devfeed.tech/topics/api.md>)

Tags: [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [api](<https://devfeed.tech/tags/api.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [c-sharp](<https://devfeed.tech/tags/c-sharp.md>), [cross-app-access](<https://devfeed.tech/tags/cross-app-access.md>), [csharp](<https://devfeed.tech/tags/csharp.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [pkce](<https://devfeed.tech/tags/pkce.md>), [sdk](<https://devfeed.tech/tags/sdk.md>), [xaa](<https://devfeed.tech/tags/xaa.md>)

### AI overview

This tutorial explains how Cross App Access (XAA) extends user identity and enterprise policy to downstream applications, MCP servers, APIs, and agent tools. It demonstrates the XAA token-exchange flow and shows how to implement a secure MCP client in C# with an MCP SDK.

### Source excerpt

A few years ago, getting a user signed in to an application or multiple applications with Single Sign-On (SSO) was enough; OpenID Connect (OIDC) handled the login, JWTs carried the claims, and Proof Key for Code Exchange (PKCE) made it secure. Today, with evolving AI, agents act on behalf of users and seek multiple accesses across different resources to execute a task. And that is when you'll hit the gap. The user has an identity, but the downstream service--like a Model Context Protocol (MCP) server, an API, or an agent tool has no way to trust it: the ID Token that proves the user's identity for your app, not for that service. You need a way to take that identity and have it trusted further down the chain, in line with the org's policy, without asking the user to log in again. Cross App Access (XAA) solves exactly that. The user authenticates once. The Identity Provider (IdP) evaluates the enterprise policy and issues a signed Identity Assertion. The downstream service exchanges that assertion for a scoped Bearer token. In this post, we'll explore how Cross App Access (XAA) closes the trust gap, test the flow using an XAA playground, and implement a secure MCP client in just a few lines of C# using our dedicated SDK. Table of Contents What is Cross App Access (XAA)? Implementing XAA with the C# MCP SDK Building the OIDC flow Automate XAA token exchange with C# SDK Connect the MCP client to the server Testing your C# MCP app with xaa.dev Run your C# MCP app with xaa.dev Learn More About Secure AI Agent Development with C# and MCP What is Cross App Access (XAA)? Before we start implementing and building the application, it is important to understand the mechanics of Cross App Access (XAA). At its core, XAA is an open standard that securely enables AI agents to act on behalf of a user and communicate with downstream applications without requiring constant, manual user consent. While the flow is sophisticated, it relies on two standard interactions: RFC 8693 (Token Exc