Run a Cross App Access flow

Navigate through the pre-configured demo to watch real XAA tokens being issued and exchanged live.

ServicesIDPAuth ServerResourceMCP Server
Resource appTodoO MCP Server

XAA Flow

THE SCENARIO

You are the User. You have authorised AgentO, a pre-configured AI agent, to read your todos from TodoO, a protected API. Work through the 4 steps below to watch AgentO acquire the tokens it needs to access your data, all without you having to log in again.

✦
Start your session

Enter any email to represent yourself as the User in this demo. The flow will run using a pre-configured demo identity. No real credentials needed.

1
User Authentication (SSO)ID Token
👤 User→🔑 IDP

The user proves their identity to their Identity Provider via SSO.

2
Token ExchangeID-JAG
🤖 Agent→🔑 IDP

AgentO exchanges the user's ID Token for an Identity Assertion Authorization Grant.

3
Access Token RequestAccess Token
🤖 Agent→🔐 Auth Server

AgentO presents the ID-JAG to the Resource's Authorization Server.

4
Access Protected ResourceAPI Response
🤖 Agent→📦 Resource

AgentO calls the Resource API with the access token.

Understanding the Flow

Key Concepts

ID Token
Proves who the user is (identity)
ID-JAG
Proves the agent is authorized to act for the user
Access Token
Grants specific permissions (scopes) to resources

Why This Matters

This flow ensures agents can only access what users explicitly allow, with each service verifying trust independently. No single point of compromise can grant unauthorized access.

Demo Assumptions

You
The User - your demo email is your identity
AgentO
Pre-configured AI agent acting as the requesting app
IdentO
Built-in demo Identity Provider (IDP)
TodoO
Pre-configured API acting as the resource server