Cross App Access
Let your apps and agents act for each other.
Governed. Scoped. Provable.
App-to-app and AI-agent-to-app access on a verifiable actor chain — built on the IETF ID-JAG grant. IT approves each App A → App B edge once; AuthFI mints a short-lived, scoped grant for every call. No consent-screen sprawl. No shared API keys.
Available on Enterprise and above. See pricing
Token exchange, not keys
One app asks. The IdP signs. The next app trusts.
Cross App Access is RFC 8693 token exchange with governance bolted on. App A presents the identity token it already holds for a user or agent and asks AuthFI to swap it for the right to act in App B. AuthFI checks the App A → App B edge, then mints an ID-JAG — the IETF Identity Assertion JWT Authorization Grant — scoped to one audience and one redemption. App B verifies the IdP signature and accepts it. No secret ever crosses the edge.
- The request: a standard
grant_type=token-exchangecall with asubject_tokenand the targetaudience— RFC 8693 verbatim, not a bespoke API. - The grant: the ID-JAG is a signed JWT (RFC 7523 bearer assertion), so App B validates it against the IdP's published JWKS — no out-of-band key sharing.
- The boundary: App B trusts only what AuthFI signed. A raw key from App A is never on the wire, so there's nothing in App A to leak.
# App A → AuthFI : RFC 8693 token exchange
POST /oauth2/token HTTP/1.1
Host: acme.authfi.io
grant_type=urn:ietf:params:oauth:
grant-type:token-exchange
subject_token=<App A's user token>
audience=app-b
scope=calendar.read
# ← AuthFI returns a short-lived ID-JAG (a signed JWT)
# scoped to aud=app-b, single redemption, minutes TTLA standard exchange request in, an IdP-signed ID-JAG out — bound to one audience and one use.
Four actors, one decider
AuthFI sits in the middle of every hop.
It decides, per edge, who may act for whom, where, and with what scope — and signs a short-lived grant for the hop. App B never sees a raw key from App A; it trusts only what AuthFI signed.
AuthFI (the IdP)
Sits in the middle and decides, per edge, who may act for whom — and signs a short-lived grant.
App A
The calling app the user (or agent) is signed into. It asks AuthFI for a grant to act in App B.
App B
The resource app. It trusts only AuthFI-signed grants — never a raw key from App A.
User or AI agent
The originating principal the whole chain is on behalf of. A person at a login, or an autonomous agent.
Built on token exchange
The four pieces that make it governable.
Cross App Access extends the RFC 8693 token exchange AuthFI already issues — adding the catalog, the actor chain, and the lifecycle controls that turn raw delegation into something IT can actually approve, audit, and revoke.
A per-edge grant catalog
IT pre-approves the App A → App B edge once: which scopes, delegation or impersonation, whether agents may traverse it. No per-user consent dance.
A verifiable act chain
Every issued token carries an RFC 8693 act claim — sub = the user, act = App A, act = the agent. Each hop is provable, all the way down.
Short-lived, single-use grants
The ID-JAG is minted for one redemption, scoped to one audience, and expires in minutes. A stolen grant is near-worthless and can't be replayed.
Default-deny by edge
No grant, no access — full stop. Scopes are capped to what IT approved and to what the user actually holds, whichever is narrower.
Delegation (acting on behalf of the user) and impersonation (acting as the user) are both expressible in RFC 8693 — AuthFI gates which one an edge is allowed to use, so a CTO chooses the trust model per integration instead of inheriting whatever the apps negotiate.
The act-chain receipt
See exactly who acted for whom.
When App B receives a call, the decoded token isn't an anonymous client — it's a chain. The end user
is sub; each intermediary nests under act, the delegation claim defined in
RFC 8693. Every hop, traceable, in one signed token — not reconstructed from logs after the fact.
- sub is the originating principal the whole chain runs on behalf of — here, the user.
- Each act nests the next intermediary inward: App A acted, and it did so via an agent.
- Because the chain is signed by the IdP, App B authorizes on a fact, not a guess — and the audit trail is the token itself.
{
"iss": "https://acme.authfi.io",
"sub": "alice@acme.com", ← the user
"aud": "app-b",
"scope": "calendar.read",
"act": { ← App A acted
"sub": "app-a",
"act": { ← via an agent
"sub": "agent:scheduler-bot"
}
}
}This is what "App A, via scheduler-bot, acting for Alice" looks like as a claim — signed by the IdP, not inferred from a log.
Central revocation
Cut access at the right grain — instantly.
Because every grant flows through one IdP, you revoke in one place — at whatever scope the situation calls for. No hunting for keys scattered across a dozen services, and no waiting on a dozen apps to rotate a shared secret.
Suspend App A → App B and every future grant across it stops at once.
Revoke a single user's consent — others on the same edge are untouched.
Pull an agent's ability to traverse an edge without disturbing the humans on it.
Invalidate a single ID-JAG by its jti — the next redemption is rejected.
Short TTLs and central revocation are two halves of the same control: even between revocations, a grant expires in minutes — so the blast radius of any single leaked ID-JAG is one audience, one redemption, already counting down. Every issued and redeemed grant lands in the audit timeline, so revocation is the end of a story you can already see.
Standards, not a silo
An open wire format on both sides of the edge.
AuthFI implements the IETF ID-JAG grant (Identity Assertion JWT Authorization Grant), aligned with OpenID IPSIE — the Cross App Access direction Okta, Microsoft and Ping are building toward. An open format means apps and agents you don't control can still join the chain — no proprietary lock-in on either side.
Govern every app-to-app and agent-to-app call.
A verifiable actor chain on every hop, approved per edge by IT, revocable in one place. No consent-screen sprawl, no shared keys — built on an open standard.
Get started
Ready to get started?
Free for 5,000 monthly active users. No credit card required.