--- title: "Build a Secure C# MCP App with Cross App Access (XAA)" url: https://daily.dev/posts/build-a-secure-c-mcp-app-with-cross-app-access-xaa--tsx6btqlc source_url: https://developer.okta.com/blog/2026/07/16/csharp-mcp-cross-app-access type: article source: "Okta Dev" published: 2026-07-16T19:46:10.176Z updated: 2026-07-16T20:21:11.242Z tags: ["ai-agents", "c#", "mcp", "oauth"] reading_time: 8 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Build a Secure C# MCP App with Cross App Access (XAA) **[Okta Dev](https://daily.dev/sources/okta)** · 8 min read · 1 upvotes · 0 comments ## Summary Cross App Access (XAA) solves the trust gap when AI agents need to act on behalf of users across multiple downstream services. Using two standard RFCs (RFC 8693 Token Exchange and RFC 7523 JWT Bearer Grant), XAA lets a user authenticate once and have that identity trusted further down the chain. The post walks through implementing a secure C# MCP client using Okta's C# MCP SDK, which abstracts the cryptographic handshakes into a clean interface via `IdentityAssertionGrantProvider`. Steps covered include configuring OIDC with PKCE in ASP.NET Core, automating the two-hop token exchange, and connecting the MCP client to a resource server. The xaa.dev playground is used to test the full end-to-end flow without infrastructure overhead. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Setting Up and Testing Cross App Access \(XAA\) in Auth0](https://daily.dev/posts/setting-up-and-testing-cross-app-access-xaa-in-auth0-rdbk9hf6k) · Auth0 · 0 upvotes · 0 comments - [Adopting the Cross App Access Protocol in Auth0](https://daily.dev/posts/adopting-the-cross-app-access-protocol-in-auth0-a9xr9ozv8) · Auth0 · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#c#](https://daily.dev/tags/c#), [#mcp](https://daily.dev/tags/mcp), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/build-a-secure-c-mcp-app-with-cross-app-access-xaa--tsx6btqlc)