Cross App Access (ID-JAG)
IETF OAuth draft (Identity Assertion JWT Authorization Grant) letting an app use an SSO identity assertion, via the trusted IdP, to get access tokens for a third-party API.
Tags
Description
Coordinates through the identity provider the downstream resource authorization server already trusts for SSO, using Token Exchange. xaa.dev is a free, open sandbox for testing cross app access flows with ID-JAG.
Related
- MCP Authorization (OAuth 2.1 for MCP): The MCP specification's transport-level authorization flow for HTTP-based MCP servers, based on a subset of OAuth 2.1 and related RFCs.
- OAuth Client ID Metadata Document (CIMD): IETF OAuth draft letting a client identify itself with a URL as its client_id, pointing to a metadata document, without prior dynamic registration.
- RFC 8693: OAuth 2.0 Token Exchange: IETF Proposed Standard for exchanging one security token for another at the token endpoint, enabling delegation and impersonation flows.
Guides & comparisons
- Add OAuth authorization to your own MCP server (Guide): A server-side walkthrough of the MCP 2026-07-28 authorization spec: publish RFC 9728 protected resource metadata, answer 401 and 403 challenges, verify JWT audience per RFC 8707, enforce per-tool scopes, and never pass tokens through. Tested with the MCP TypeScript SDK v2.
- Agent auth and delegated access, step by step (Guide): How an agent acts for a user without holding their passwords: CIMD client registration, the MCP 2026-07-28 OAuth flow with resource indicators and audience checks, no token passthrough, vaulted third-party tokens, CIBA approvals and Cross App Access (ID-JAG).
Sources
Machine-readable
- JSON
- Markdown
- Source file on GitHub (edit via pull request)