A curated list of resources for Cross-App Access (XAA) and the Identity Assertion JWT Authorization Grant (ID-JAG).
A curated list of resources for Cross-App Access (XAA) and the Identity Assertion JWT Authorization Grant (ID-JAG).
Cross-App Access is an OAuth extension that lets an enterprise identity provider govern app-to-app API access. Instead of every user clicking through a per-app OAuth consent screen, the IdP issues a signed identity assertion (the ID-JAG) that a requesting app redeems at the resource app's authorization server for an access token. Admins configure the connection once, users get access on first login, and every grant is centrally policed, scoped, and logged.
It matters most for AI agents and MCP: an agent inherits exactly the access its signed-in user already has, with short-lived tokens instead of long-lived API keys.
- How it works - Terminology - Specifications - Related standards - MCP and AI agents - Issuers - Validators - Resource apps and MCP servers - Libraries - Sample apps and demos - Sandboxes and debugging tools - Articles - Talks and podcasts - Community
Term Meaning ----------------- ---------------------------------------------------------------------------------------------------- Requesting App The app or agent that wants to call another app's API on the user's behalf. Resource App The app whose API is being called. Runs its own authorization server. Identity Provider The enterprise IdP that both apps trust for SSO, and that issues the ID-JAG. ID-JAG The identity assertion JWT the IdP issues, scoped to one requesting app, one resource, and one user. XAA Cross-App Access, the common name for deployments of this pattern. EMA Enterprise-Managed
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/dorsha--awesome-cross-app-access.html)
A curated list of awesome agentic commerce resources — protocols, MCP servers, tools, apps, APIs and services for AI agents that shop, sell and transact. For store owners, developers, agencies and mar
XiaoDuoYa/codex-with-chatgptChatGPT thinks. Codex works. Use ChatGPT as the planning brain while keeping the Codex harness.
Dominic789654/awesome-deepseek-harnessA curated list of plugins, skills, MCP servers, patch/profile layers, orchestrators & UIs for DeepSeek Harness (DSH). Visualization · PPT · Coding · Agents · Loops (auto-research) and more. #dsh
rizzdev/awesome-mcp-open janwilmake/agent-codemodeLet the scripts your coding agent writes call your connected MCP servers (no extra auth)
abluva/mcp-remoteThe bridge for remote MCP — seamless OAuth, resilient auth recovery, production-grade reliability
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.