Walk Cross App Access against your own IdP and MCP server, one step at a time, and inspect the exact request each one sends.

Now using Okta as the ID-JAG issuer.

How ID-JAG works

The agent never sees your password. It carries a signed statement about you from the ID-JAG issuer to the MCP's authorization server and trades it for a scoped access token. Click a step to inspect the request.

Configuration

Not configured

⚠︎ Saved in this browser's localStorage — client secrets and private keys in plain text, readable by any script on this origin. Fine for a local learning harness; never do this in a real app.

Configuration

Resources

Okta — ID-JAG issuance

How the requesting app exchanges a sign-in token for an ID-JAG, using the same credentials it signed in with.

Set up ID-JAG issuance →

PingFederate — token exchange

PingFederate has no dedicated ID-JAG issuance guide. ID-JAG is a requested token type you allow on an SP connection's token exchange settings.

Enable ID-JAG on token exchange →

Descope — ID-JAG issuance

How Descope's enterprise-managed authorization mints the ID JWT Authorization Grant the agent hands off.

Set up ID-JAG issuance →

Enterprise-Managed Authorization

How your internal enterprise agents are managed with Descope, both with Cross App Access (XAA) and also with our MCP Gateway.

Learn More →

Authorization Server

Set up the authorization server that takes the ID-JAG and returns a scoped access token for the MCP.

Learn More →