This is the documentation for v2 — looking for the v1 documentation?
MCP TypeScript SDK

Appearance

MCP TypeScript SDK (V2) / @modelcontextprotocol/client / client/crossAppAccess

client/crossAppAccess ​

Cross-App Access (Enterprise Managed Authorization) Layer 2 utilities.

Provides standalone functions for RFC 8693 Token Exchange and RFC 7523 JWT Authorization Grant flows as specified in the Enterprise Managed Authorization specification (SEP-990).

See ​

https://github.com/modelcontextprotocol/ext-auth/blob/main/specification/stable/enterprise-managed-authorization.mdx

Interfaces ​

DiscoverAndRequestJwtAuthGrantOptions ​

Defined in: packages/client/src/client/crossAppAccess.ts:77

Options for discovering the IdP's token endpoint and requesting a JWT Authorization Grant. Extends RequestJwtAuthGrantOptions with IdP discovery.

Extends ​

Properties ​

audience ​

audience: string | URL

Defined in: packages/client/src/client/crossAppAccess.ts:35

The authorization server URL of the target MCP server (used as audience in the token exchange request).

Inherited from ​

RequestJwtAuthGrantOptions.audience

clientId ​

clientId: string

Defined in: packages/client/src/client/crossAppAccess.ts:51

The client ID registered with the IdP for token exchange.

Inherited from ​

RequestJwtAuthGrantOptions.clientId

clientSecret? ​

optional clientSecret?: string

Defined in: packages/client/src/client/crossAppAccess.ts:60

The client secret for authenticating with the IdP.

Optional: the IdP may register the MCP client as a public client. RFC 8693 does not mandate confidential clients for token exchange. Omitting this parameter omits client_secret from the request body.

Inherited from ​

RequestJwtAuthGrantOptions.clientSecret

fetchFn? ​

optional fetchFn?: FetchLike

Defined in: packages/client/src/client/crossAppAccess.ts:70

Custom fetch implementation. Defaults to global fetch.

Inherited from ​

RequestJwtAuthGrantOptions.fetchFn

idpUrl ​

idpUrl: string | URL

Defined in: packages/client/src/client/crossAppAccess.ts:82

The IdP's issuer URL for OAuth metadata discovery. Will be used to discover the token endpoint via .well-known/oauth-authorization-server.

idToken ​

idToken: string

Defined in: packages/client/src/client/crossAppAccess.ts:46

The identity assertion (ID Token) from the enterprise IdP. This should be the OpenID Connect ID Token obtained during user authentication.

Inherited from ​

RequestJwtAuthGrantOptions.idToken

resource ​

resource: string | URL

Defined in: packages/client/src/client/crossAppAccess.ts:40

The resource identifier of the target MCP server (RFC 9728).

Inherited from ​

RequestJwtAuthGrantOptions.resource

scope? ​

optional scope?: string

Defined in: packages/client/src/client/crossAppAccess.ts:65

Optional space-separated list of scopes to request for the target MCP server.

Inherited from ​

RequestJwtAuthGrantOptions.scope

JwtAuthGrantResult ​

Defined in: packages/client/src/client/crossAppAccess.ts:88

Result from a successful JWT Authorization Grant token exchange.

Properties ​

expiresIn? ​

optional expiresIn?: number

Defined in: packages/client/src/client/crossAppAccess.ts:97

Optional expiration time in seconds for the JWT Authorization Grant.

jwtAuthGrant ​

jwtAuthGrant: string

Defined in: packages/client/src/client/crossAppAccess.ts:92

The JWT Authorization Grant (ID-JAG) that can be used to request an access token from the MCP server.

scope? ​

optional scope?: string

Defined in: packages/client/src/client/crossAppAccess.ts:102

Optional scope granted by the IdP (may differ from requested scope).

RequestJwtAuthGrantOptions ​

Defined in: packages/client/src/client/crossAppAccess.ts:26

Options for requesting a JWT Authorization Grant via RFC 8693 Token Exchange.

Properties ​

audience ​

audience: string | URL

Defined in: packages/client/src/client/crossAppAccess.ts:35

The authorization server URL of the target MCP server (used as audience in the token exchange request).

clientId ​

clientId: string

Defined in: packages/client/src/client/crossAppAccess.ts:51

The client ID registered with the IdP for token exchange.

clientSecret? ​

optional clientSecret?: string

Defined in: packages/client/src/client/crossAppAccess.ts:60

The client secret for authenticating with the IdP.

Optional: the IdP may register the MCP client as a public client. RFC 8693 does not mandate confidential clients for token exchange. Omitting this parameter omits client_secret from the request body.

fetchFn? ​

optional fetchFn?: FetchLike

Defined in: packages/client/src/client/crossAppAccess.ts:70

Custom fetch implementation. Defaults to global fetch.

idToken ​

idToken: string

Defined in: packages/client/src/client/crossAppAccess.ts:46

The identity assertion (ID Token) from the enterprise IdP. This should be the OpenID Connect ID Token obtained during user authentication.

resource ​

resource: string | URL

Defined in: packages/client/src/client/crossAppAccess.ts:40

The resource identifier of the target MCP server (RFC 9728).

scope? ​

optional scope?: string

Defined in: packages/client/src/client/crossAppAccess.ts:65

Optional space-separated list of scopes to request for the target MCP server.

tokenEndpoint ​

tokenEndpoint: string | URL

Defined in: packages/client/src/client/crossAppAccess.ts:30

The IdP's token endpoint URL where the token exchange request will be sent.

Functions ​

discoverAndRequestJwtAuthGrant() ​

discoverAndRequestJwtAuthGrant(options): Promise<JwtAuthGrantResult>

Defined in: packages/client/src/client/crossAppAccess.ts:211

Discovers the IdP's token endpoint and requests a JWT Authorization Grant.

This is a convenience wrapper around requestJwtAuthorizationGrant that first performs OAuth metadata discovery to find the token endpoint.

Parameters ​

options ​

DiscoverAndRequestJwtAuthGrantOptions

Configuration including IdP URL for discovery

Returns ​

Promise<JwtAuthGrantResult>

The JWT Authorization Grant and related metadata

Throws ​

If discovery fails or the token exchange fails

Example ​

ts
const result = await discoverAndRequestJwtAuthGrant({
    idpUrl: 'https://idp.example.com',
    audience: 'https://auth.chat.example/',
    resource: 'https://mcp.chat.example/',
    idToken: await getIdToken(),
    clientId: 'my-idp-client',
    clientSecret: 'my-idp-secret'
});

exchangeJwtAuthGrant() ​

exchangeJwtAuthGrant(options): Promise<{ access_token: string; expires_in?: number; scope?: string; token_type: string; }>

Defined in: packages/client/src/client/crossAppAccess.ts:256

Exchanges a JWT Authorization Grant for an access token at the MCP server's authorization server.

This function performs step 3 of the Enterprise Managed Authorization flow: uses the JWT Authorization Grant to obtain an access token from the MCP server.

Parameters ​

options ​

Configuration for the JWT grant exchange

authMethod? ​

ClientAuthMethod

Client authentication method. Defaults to 'client_secret_basic' to align with CrossAppAccessProvider and SEP-990 conformance requirements. Callers with no clientSecret should pass 'none' for public-client auth.

clientId ​

string

clientSecret? ​

string

fetchFn? ​

FetchLike

jwtAuthGrant ​

string

tokenEndpoint ​

string | URL

Returns ​

Promise<{ access_token: string; expires_in?: number; scope?: string; token_type: string; }>

OAuth tokens (access token, token type, etc.)

Throws ​

If the exchange fails or returns an error response

Defaults to client_secret_basic (HTTP Basic Authorization header), matching CrossAppAccessProvider's declared token_endpoint_auth_method and the SEP-990 conformance test requirements. Use authMethod: 'client_secret_post' only when the authorization server explicitly requires it.

Example ​

ts
const tokens = await exchangeJwtAuthGrant({
    tokenEndpoint: 'https://auth.chat.example/token',
    jwtAuthGrant: 'eyJhbGci...',
    clientId: 'my-mcp-client',
    clientSecret: 'my-mcp-secret'
});

// Use tokens.access_token to access the MCP server

requestJwtAuthorizationGrant() ​

requestJwtAuthorizationGrant(options): Promise<JwtAuthGrantResult>

Defined in: packages/client/src/client/crossAppAccess.ts:130

Requests a JWT Authorization Grant (ID-JAG) from an enterprise IdP using RFC 8693 Token Exchange.

This function performs step 2 of the Enterprise Managed Authorization flow: exchanges an ID Token for a JWT Authorization Grant that can be used with the target MCP server.

Parameters ​

options ​

RequestJwtAuthGrantOptions

Configuration for the token exchange request

Returns ​

Promise<JwtAuthGrantResult>

The JWT Authorization Grant and related metadata

Throws ​

If the token exchange fails or returns an error response

Example ​

ts
const result = await requestJwtAuthorizationGrant({
    tokenEndpoint: 'https://idp.example.com/token',
    audience: 'https://auth.chat.example/',
    resource: 'https://mcp.chat.example/',
    idToken: 'eyJhbGciOiJS...',
    clientId: 'my-idp-client',
    clientSecret: 'my-idp-secret',
    scope: 'chat.read chat.history'
});

// Use result.jwtAuthGrant with the MCP server's authorization server