# id-jag

Source: https://startwithidentity.com/glossary/id-jag/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

The Identity Assertion JWT Authorization Grant (ID-JAG) is a signed JWT, issued by an enterprise identity provider through OAuth 2.0 Token Exchange (RFC 8693), that a client presents as a JWT authorization grant (RFC 7523) to a third-party authorization server to get an access token for that server's API without a user consent prompt. It is defined in [draft-ietf-oauth-identity-assertion-authz-grant](https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/), an active IETF OAuth Working Group draft that is not yet an RFC as of October 2026.

The flow has three steps: the user signs in to the requesting app through the IdP with OpenID Connect or SAML, the app exchanges that ID token (or a refresh token) at the IdP for an ID-JAG naming the target resource, and the app redeems the ID-JAG at the resource's authorization server. The token carries the `typ` header `oauth-id-jag+jwt` and its own token type URN, so it cannot be confused with an ID token. What changes for security teams is where the decision sits: the IdP, not each end user, decides which app may reach which API, and the IdP can refuse or log every connection. ID-JAG is the mechanism behind Cross App Access and the Model Context Protocol's Enterprise-Managed Authorization extension.

See also: [Cross App Access](https://startwithidentity.com/glossary/cross-app-access/), [identity chaining](https://startwithidentity.com/glossary/identity-chaining/), [token exchange](https://startwithidentity.com/glossary/token-exchange/), [MCP authorization](https://startwithidentity.com/glossary/mcp-authorization/), [agentic identity](https://startwithidentity.com/glossary/agentic-identity/), [Aaron Parecki](https://startwithidentity.com/experts/aaron-parecki/), [agent identity standards map 2026](https://startwithidentity.com/reports/agent-identity-standards-map-2026/)