Forty people using four tools across their agents means a hundred and sixty individual OAuth flows, each one a consent screen and a stored credential. Cross App Access (XAA) replaces that pattern. Built on the IETF Identity Assertion JWT Authorization Grant and folded into MCP as its Enterprise-Managed Authorization extension, XAA lets the enterprise identity provider govern how agents connect.

Scalekit is in Okta's first wave of XAA partners. An admin approves the connector once in Okta, and everyone in the relevant IdP groups gets access automatically: short-lived, task-scoped tokens issued from each person's existing identity and group policy, with no per-user consent screens and no API keys in circulation. Revocation happens where the security team already works.

How it works

• The agent presents a signed ID-JAG assertion from the enterprise IdP and exchanges it at Scalekit's /oauth/token endpoint using the JWT bearer grant.
• Scalekit enforces the configured scopes before issuing a short-lived access token; no long-lived keys are involved.
• MCP servers validate the resulting Bearer token exactly as they do today; enabling XAA is a dashboard toggle, not a code change.
• Every token request is logged through the IdP's audit system, so governance stays in one place.

Read the XAA docs to get started.