<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/build-a-secure-c-mcp-app-with-cross-app-access-xaa--tsx6btqlc" -->

---
title: Build a Secure C# MCP App with Cross App Access (XAA)
description: Cross App Access (XAA) solves the trust gap when AI agents need to act on behalf of users across multiple downstream services. Using two standard RFCs (RFC...
canonical: https://daily.dev/posts/build-a-secure-c-mcp-app-with-cross-app-access-xaa--tsx6btqlc
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: Build a Secure C# MCP App with Cross App Access (XAA) | daily.dev
og:description: Cross App Access (XAA) solves the trust gap when AI agents need to act on behalf of users across multiple downstream services. Using two standard RFCs (RFC...
og:url: https://daily.dev/posts/build-a-secure-c-mcp-app-with-cross-app-access-xaa--tsx6btqlc
og:image: https://api.daily.dev/og/posts/tSX6btqlc.png
og:image:alt: Build a Secure C# MCP App with Cross App Access (XAA)
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Build a Secure C# MCP App with Cross App Access (XAA)

**[Okta Dev](https://daily.dev/sources/okta)** · 8 min read · 1 upvotes · 0 comments

## Summary

Cross App Access (XAA) solves the trust gap when AI agents need to act on behalf of users across multiple downstream services. Using two standard RFCs (RFC 8693 Token Exchange and RFC 7523 JWT Bearer Grant), XAA lets a user authenticate once and have that identity trusted further down the chain. The post walks through implementing a secure C# MCP client using Okta's C# MCP SDK, which abstracts the cryptographic handshakes into a clean interface via `IdentityAssertionGrantProvider`. Steps covered include configuring OIDC with PKCE in ASP.NET Core, automating the two-hop token exchange, and connecting the MCP client to a resource server. The xaa.dev playground is used to test the full end-to-end flow without infrastructure overhead.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://developer.okta.com/blog/2026/07/16/csharp-mcp-cross-app-access>

## Questions this post answers

### What is Cross App Access (XAA) and how does it let AI agents access MCP servers securely?

Cross App Access is an open standard that lets an identity provider issue a signed identity assertion so a downstream service, like an MCP server, can trust a user's identity without re-authentication. It combines RFC 8693 token exchange, where an OIDC ID token is exchanged for a JWT Authorization Grant, with RFC 7523 JWT bearer grants, where that grant is presented to get a scoped access token for the resource.

_Teams wiring AI agents into internal tools can track patterns like XAA and MCP auth on daily.dev._

### How do I connect a C# MCP client to a server using an exchanged access token?

Configure an HttpClientTransport with the MCP server endpoint, StreamableHttp transport mode, and an Authorization header carrying the Bearer access token obtained from the token exchange. Then call McpClient.CreateAsync with that transport, which performs the MCP initialization handshake exchanging protocol version and capabilities before you can call methods like ListResourcesAsync or ReadResourceAsync.

_Developers building MCP clients can follow implementation details like this via daily.dev._

### What SDK component handles the XAA token exchange steps in a C# application?

The IdentityAssertionGrantProvider class in the C# MCP SDK encapsulates both exchanges: presenting a user's ID token to the identity provider to receive a short-lived ID-JAG, then exchanging that ID-JAG for a scoped access token at the MCP authorization server. It requires configuration such as ClientId, IdpTokenEndpoint, IdpClientId, scope, and an IdTokenCallback to fetch the session's current ID token.

_Anyone integrating identity assertion grants into an agent stack can keep up with SDK patterns on daily.dev._

## Similar posts on daily.dev

- [Setting Up and Testing Cross App Access \(XAA\) in Auth0](https://daily.dev/posts/setting-up-and-testing-cross-app-access-xaa-in-auth0-rdbk9hf6k) · Auth0 · 0 upvotes · 0 comments
- [Adopting the Cross App Access Protocol in Auth0](https://daily.dev/posts/adopting-the-cross-app-access-protocol-in-auth0-a9xr9ozv8) · Auth0 · 0 upvotes · 0 comments
- [Introducing xaa.dev: A Playground for Cross App Access](https://daily.dev/posts/introducing-xaa-dev-a-playground-for-cross-app-access-heotx2sl7) · Okta Dev · 1 upvotes · 0 comments
- [What is Cross-App Access \(XAA\) and How It Works](https://daily.dev/posts/what-is-cross-app-access-xaa-and-how-it-works-hm360dpyi) · Descope · 0 upvotes · 0 comments

---

Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp), [#c#](https://daily.dev/tags/c#), [#oauth](https://daily.dev/tags/oauth)

[View this post on daily.dev](https://daily.dev/posts/build-a-secure-c-mcp-app-with-cross-app-access-xaa--tsx6btqlc)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"Build a Secure C# MCP App with Cross App Access (XAA)","url":"https://daily.dev/posts/build-a-secure-c-mcp-app-with-cross-app-access-xaa--tsx6btqlc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/build-a-secure-c-mcp-app-with-cross-app-access-xaa--tsx6btqlc"},"datePublished":"2026-07-16T19:46:10.176Z","dateModified":"2026-09-14T08:01:53.842Z","description":"Cross App Access (XAA) solves the trust gap when AI agents need to act on behalf of users across multiple downstream services. Using two standard RFCs (RFC...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3f27ea38789d43b0b0075c7a3067c962?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3f27ea38789d43b0b0075c7a3067c962?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Okta Dev","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Okta Dev","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/17da1ccc02574ef9838f856af0e10def","url":"https://daily.dev/sources/okta"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/build-a-secure-c-mcp-app-with-cross-app-access-xaa--tsx6btqlc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,mcp,c#,oauth","timeRequired":"PT8M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Okta Dev","item":"https://daily.dev/sources/okta"},{"@type":"ListItem","position":3,"name":"Build a Secure C# MCP App with Cross App Access (XAA)"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/build-a-secure-c-mcp-app-with-cross-app-access-xaa--tsx6btqlc#faq","mainEntity":[{"@type":"Question","name":"What is Cross App Access (XAA) and how does it let AI agents access MCP servers securely?","acceptedAnswer":{"@type":"Answer","text":"Cross App Access is an open standard that lets an identity provider issue a signed identity assertion so a downstream service, like an MCP server, can trust a user's identity without re-authentication. It combines RFC 8693 token exchange, where an OIDC ID token is exchanged for a JWT Authorization Grant, with RFC 7523 JWT bearer grants, where that grant is presented to get a scoped access token for the resource. Teams wiring AI agents into internal tools can track patterns like XAA and MCP auth on daily.dev."}},{"@type":"Question","name":"How do I connect a C# MCP client to a server using an exchanged access token?","acceptedAnswer":{"@type":"Answer","text":"Configure an HttpClientTransport with the MCP server endpoint, StreamableHttp transport mode, and an Authorization header carrying the Bearer access token obtained from the token exchange. Then call McpClient.CreateAsync with that transport, which performs the MCP initialization handshake exchanging protocol version and capabilities before you can call methods like ListResourcesAsync or ReadResourceAsync. Developers building MCP clients can follow implementation details like this via daily.dev."}},{"@type":"Question","name":"What SDK component handles the XAA token exchange steps in a C# application?","acceptedAnswer":{"@type":"Answer","text":"The IdentityAssertionGrantProvider class in the C# MCP SDK encapsulates both exchanges: presenting a user's ID token to the identity provider to receive a short-lived ID-JAG, then exchanging that ID-JAG for a scoped access token at the MCP authorization server. It requires configuration such as ClientId, IdpTokenEndpoint, IdpClientId, scope, and an IdTokenCallback to fetch the session's current ID token. Anyone integrating identity assertion grants into an agent stack can keep up with SDK patterns on daily.dev."}}]}
```