xaa.rocks

Cross App Access, end to end.

A suite of open test tools for Cross App Access: an app gets access to another app's API on the user's behalf through the enterprise identity provider both already trust, with no consent screen in between. Every tool here is one real party in that flow, and shows its work.

  1. Clientsigns the user in with the IdP
  2. Identity providertrades the ID token for an ID-JAG
  3. Gatewayoptional
  4. Resource AppAPI or MCP

Start here

  1. Get a sandbox at the IdP. Sign up at identity-provider.net; it takes no password.
  2. Point the client at it. Add identity-provider.net as an IdP in client.xaa.rocks, and register the client in your sandbox.
  3. Run a flow against motd. motd.xaa.rocks accepts any issuer's ID-JAG, so there is nothing else to set up. Then try todo and TinyWiki.

Client

The requesting app: it wants to reach another app's API on the user's behalf.

client.xaa.rocks

Up

Client

A Cross App Access tester. It runs the whole flow one step at a time, showing every request and response with a copy-as-curl button: ID token to ID-JAG to access token to API call over OpenID Connect, or through a SAML assertion and a refresh token. It can discover MCP servers from a URL, and publishes its own Client ID Metadata Document for private_key_jwt.

Use it for Test an IdP or a resource app from the client side: add an IdP from its discovery document or SAML metadata, add a resource, and run a flow.

xaa.dev

Up

Client

One part of xaa.dev, an independent playground from Okta with a client, an identity provider and a resource app of its own.

The requesting app in xaa.dev, Okta's XAA playground. It runs a live, preconfigured flow with no accounts or setup: sign in at the playground's IdP, trade the ID token for an ID-JAG, trade that for an access token, and call a protected API, showing every token on the way.

Use it for Seeing a complete flow in seconds, and as a reference for a requesting app of your own.

Identity provider

The enterprise IdP the user signs in to, and that every other party already trusts. It trades the user's identity assertion for an ID-JAG addressed to the app being called.

identity-provider.net

Up

Enterprise IdP

A stub enterprise identity provider speaking OpenID Connect and SAML, with simulated login. Its token endpoint mints ID-JAGs by token exchange from an ID token, a refresh token or a SAML assertion, on behalf of a non-participating upstream IdP such as Entra, and from Identity Continuation Assertions. It is also a Workload IdP for Workload Authorization Grants.

Use it for Sign up for a private sandbox, then register the clients, SAML apps, resource authorization servers, upstream IdPs and gateways you want to test against.

xaa.dev

Up

Identity provider

One part of xaa.dev, an independent playground from Okta with a client, an identity provider and a resource app of its own.

IdenX, the identity provider in xaa.dev, speaking OpenID Connect and SAML and issuing ID-JAGs by token exchange. Register your own requesting app with it to run the flow from your code, and watch its logs in the playground's service inspector.

Use it for Developing a requesting app against a ready-made IdP, authorization server and API.

Gateway optional

Optional: sits between the client and the resource apps it calls, and carries the user's grant on to each of them without ever holding the user's identity assertion.

gateway.xaa.rocks

Up

MCP gateway

A multi-tenant MCP gateway that reaches downstream MCP servers on the user's behalf without ever seeing the user's identity assertion, using Identity Continuation: it accepts an ID-JAG, and asks the IdP for an onward one for each hop. Uses DPoP and Client ID Metadata Documents.

Use it for The gateway pattern with identity-provider.net, where the gateway is registered under Gateways.

Resource apps

Where the access ends up: an API or an MCP server. Most have their own authorization server that accepts an ID-JAG and issues access tokens for them.

todo.xaa.rocks

Up

API

A multi-tenant todo list with its own authorization server and API. Several tenants can share one IdP issuer, and the token endpoint tells them apart by the ID-JAG's aud_tenant claim. Each tenant signs in over OpenID Connect or SAML.

Use it for The multi-tenant case: two tenants on the same IdP issuer with different client IDs.

xaa.dev

Up

API + MCP

One part of xaa.dev, an independent playground from Okta with a client, an identity provider and a resource app of its own.

The resource side of xaa.dev: an authorization server that validates ID-JAGs and issues scoped access tokens, in front of a REST API and an MCP server. It also tests your own resource app, whether it runs its own authorization server or not.

Use it for Checking a resource app or MCP server you are building against a known-good IdP and client.

oncall.xaa.rocks

Up

MCP

An on-call MCP server that issues no tokens of its own and only verifies yours: bring an Okta custom authorization server or an Auth0 tenant, and it reads the scopes and roles out of the access tokens they mint. Four tools, two of which need a scope a client will not have on its first token, and one a role; all four are listed whatever the token says, and a refusal names the scope or role that is missing. It takes access tokens, not ID-JAGs.

Use it for MCP client authorization and step-up. Each account gets its own MCP endpoint, and signing up needs no username or password: a passkey or a recovery URL gets you back in.

Coming soon: Workload Authorization Grants

Agents getting access without a user: an Agent Platform vouches for the agent, the enterprise's Workload IdP issues a grant, and the application trusts the IdP.

workload-api

Coming soon

Application

An application whose authorization server accepts Workload Authorization Grants from trusted identity providers and issues access tokens for its API.