IETF OAuth · Protocol

Identity Assertion JWT Authorization Grant

Lets an application present the identity assertion it got from the enterprise identity provider to obtain, through that provider, an access token for a third-party API, so the enterprise stays in control of which apps may talk to which.

Working group draftWorking group document, intended Standards Track; known informally as Cross-App AccessCanonical documentid-jag

Revisions

draft-042026-05-21current
draft-002025-09-08superseded
Adopted by the OAuth working group; replaces the individual draft.
draft-parecki-052025-07-02superseded
draft-parecki-002024-03-01superseded

Relations 6

Identity Assertion JWT Authorization Grant builds on 2

JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization GrantspublishedThe resulting JWT authorization grant is presented to the resource's authorization server as a JWT bearer assertion.Source
OAuth 2.0 Token ExchangepublishedThe identity assertion is exchanged at the enterprise identity provider using the token exchange grant.Source

Identity Assertion JWT Authorization Grant references 1

OpenID Connect Core 1.0publishedAn ID Token is one of the identity assertions the client can present.Source

Identity Assertion JWT Authorization Grant is built on by 1

MCP Enterprise-Managed AuthorizationpublishedThe token the MCP client presents is obtained through the identity assertion grant.Source

Identity Assertion JWT Authorization Grant is profiled by 1

Cross App Access (XAA)publishedOkta's product implements the draft's flow and names its deployment constraints.Source

Identity Assertion JWT Authorization Grant is referenced by 1

auth.mdpublishedIts "agent verified" registration path uses the identity assertion grant.Source

Defines in the shared model

No features of this document are recorded yet. Features are what the atlases observe and the explorer cites; they are added as the products need them.