Picture a product manager who asks Claude for a launch readiness summary. To build it, the agent has to pull milestones from Asana or Linear, documents from Atlassian, designs from Figma or Canva, and meeting notes from Zoom or Granola. Under Okta’s Cross App Access framework, every one of those requests runs against the manager’s active Okta identity and gets checked against company policy before any data moves. Each action is logged and limited to what the agent needs.
On June 23, Okta said more than 25 software makers have signed on to the framework, known as XAA. Early adopters include Asana, Atlassian, Cloudflare, Datadog, Zoom, Slack (part of Salesforce) and Anthropic’s Claude. Canva, Docker, Figma, Linear, Supabase, Cursor and Microsoft’s Visual Studio Code are also on the roster.
Okta introduced XAA in June 2025 to govern agent-to-app and app-to-app connections. It is built as an extension of OAuth, and it now serves as an official authorization extension for the Model Context Protocol, the standard that links AI models to outside data and tools.
Three roles
Okta sorts its partners into three groups. Requesting apps, such as Claude, Cursor, Docker, Visual Studio Code and Zoom, are the agents and developer tools that ask for data. Resource apps hold that data. They include Asana, Atlassian, Canva, Datadog, Figma, Glean, Granola, Linear, Serval, Slack, Supabase and Zoom, which plays both parts.
The third group handles the traffic in between: identity infrastructure, gateways and frameworks. Aquera, Archestra.AI, Cloudflare, Keycard Labs, Keycloak, MintMCP, Scalekit, Stytch, WorkOS and Zuplo are in it.
“With AI agents becoming increasingly core to daily workflows, organizations are aligning around XAA as the secure path to deploy agents in production,” said Ely Kahn, Okta’s chief product officer. He described the expansion as part of Okta’s push for open, vendor-neutral standards.
Zoom signed on as both a requesting and a resource app. “By supporting Cross App Access as both a requesting and resource application, we’re ensuring that AI agents can securely bring meeting context to other workflows,” said Brendan Ittelson, Zoom’s chief ecosystem officer.
SDKs and a live beta
To push XAA toward standard status, the official MCP software development kits are adopting it as an enterprise-managed authorization extension. TypeScript and Java support is available. Python is planned.
Okta also points to Anthropic’s beta program, where it is the featured identity provider. Ramp, Webflow and HubSpot are among the joint customers using it to govern how Claude reaches participating MCP providers. The program is meant to test whether the protocol can centralize authorization, enforce access policies and automatically remove agent permissions once they are no longer needed.
Okta Workforce customers can get supported XAA applications through the Okta Integration Network starting in August. Auth0 B2B software-as-a-service customers get early access at the end of July.
