Callback function that provides a JWT Authorization Grant (ID-JAG).
The callback receives the MCP server's authorization server URL, resource URL, and requested scope, and should return a JWT Authorization Grant obtained from the enterprise IdP via RFC 8693 token exchange.
You can use the utility functions from the crossAppAccess module
for standard flows, or implement custom logic.
assertion: async (ctx) => {
const result = await discoverAndRequestJwtAuthGrant({
idpUrl: 'https://idp.example.com',
audience: ctx.authorizationServerUrl,
resource: ctx.resourceUrl,
idToken: await getIdToken(),
clientId: 'my-idp-client',
clientSecret: 'my-idp-secret',
scope: ctx.scope,
fetchFn: ctx.fetchFn
});
return result.jwtAuthGrant;
}
The client_id registered with the MCP server's authorization server.
OptionalclientOptional client name for metadata.
The client_secret for authenticating with the MCP server's authorization server.
OptionalfetchCustom fetch implementation. Defaults to global fetch.
Options for creating a
CrossAppAccessProvider.