Ask Claude to prepare a launch readiness summary and it may need project milestones from Asana, documentation from Atlassian, designs from Figma and notes from a Zoom meeting. Okta wants each of those requests to travel under the employee’s own Okta identity, not under a standing credential the agent carries around.
That is the idea behind Cross App Access, or XAA, and on June 23 Okta announced that 25-plus companies have signed on. The list of early adopters includes Anthropic, Asana, Atlassian, Canva, Cloudflare, Cursor, Datadog, Docker, Figma, Glean, Granola, Linear, Slack, Supabase, VS Code, WorkOS, Zoom and Zuplo, along with identity and gateway firms such as Aquera, Archestra.AI, Keycard, Keycloak, MintMCP, Scalekit, Serval and Stytch by Twilio.
XAA is built as an extension of OAuth and is now an official authorization extension for the Model Context Protocol, the standard that connects AI models to outside data and tools. Okta describes it as an open, vendor-neutral protocol that it initially led.
What changes for the company
Under the old habit, an agent often holds a static API key. XAA swaps that for tokens tied to the user’s identity and limited to what the agent needs. The request is checked against company policy first, and every action lands in a central audit trail, which gives IT teams a record of what an agent did and where.
Okta sorts the partners into three roles. Requesting apps, among them Claude, Cursor, Docker, VS Code and Zoom, are the agents and developer tools that ask for data. Resource apps are the downstream systems that hold it, such as Asana, Atlassian, Datadog, Supabase and Slack. The third group, identity infrastructure and gateways, carries the traffic between the two.
A developer’s day looks similar. An engineer might ask an agent in Cursor, Docker or VS Code to inspect code or check deployment readiness, and the agent could need database details from Supabase or reliability data from Datadog.
“With AI agents becoming increasingly core to daily workflows, organizations are aligning around XAA as the secure path to deploy agents in production,” said Ely Kahn, Okta’s chief product officer.
Where it stands
Official MCP software development kits are adopting XAA as the Enterprise-Managed Authorization extension. TypeScript and Java support is available, and Python is in progress.
Anthropic is running a beta program with Okta as the featured identity provider. HubSpot, Ramp and Webflow are among the joint customers using it to govern their use of Claude and its access to participating MCP providers. Okta says the program helps test whether the protocol can centralize authorization, enforce access policies and automate the removal of agent permissions.
Okta Workforce customers can begin accessing supported XAA applications through the Okta Integration Network starting in August 2026.
Sources
- Okta advances the industry standard for secure AI agent connections with expanding Cross App Access ecosystem
- Okta expands Cross App Access to secure AI agent enterprise connections
