Walk Cross App Access against your own IdP and MCP server, one step at a time, and inspect the exact request each one sends.

Now using Okta as the ID-JAG issuer.

How ID-JAG works

The agent never sees your password and never gets a token it can reuse elsewhere. It carries a signed statement about you from the ID-JAG issuer to the MCP's authorization server, and trades it for a scoped access token. Click any step to see the request on the right.

Configuration

Not configured

⚠︎ Saved in this browser's localStorage — client secrets and private keys in plain text, readable by any script on this origin. Fine for a local learning harness; never do this in a real app.

Configuration

Resources

Enterprise-Managed Authorization

How Cross App Access works on Descope: an app calls another app's API on a user's behalf, without the user in the loop.

Learn More →

Issuing ID-JAGs

How Descope's enterprise-managed authorization mints the ID JWT Authorization Grant the agent hands off.

Learn More →

Inbound Apps

Set up the authorization server that takes the ID-JAG and returns a scoped access token for the MCP.

Learn More →