Build a Secure C# MCP App with Cross App Access (XAA)

Cross App Access (XAA) solves the trust gap when AI agents need to act on behalf of users across multiple downstream services. Using two standard RFCs (RFC 8693 Token Exchange and RFC 7523 JWT Bearer Grant), XAA lets a user authenticate once and have that identity trusted further down the chain. The post walks through implementing a secure C# MCP client using Okta's C# MCP SDK, which abstracts the cryptographic handshakes into a clean interface via `IdentityAssertionGrantProvider`. Steps covered include configuring OIDC with PKCE in ASP.NET Core, automating the two-hop token exchange, and connecting the MCP client to a resource server. The xaa.dev playground is used to test the full end-to-end flow without infrastructure overhead.