Link your enterprise identity for Cross-App Access
Cross-App Access / ID-JAG datasources (see Connect an MCP Server, Cross-App Access tab) exchange your own inbound identity token for a resource-scoped access token at the upstream's Authorization Server. That exchange needs a live ID token from your enterprise identity provider.
When you're working in a browser, AIControls already has that token. When a tool authenticates with a personal access token (PAT) instead — the normal path for Claude Code and other CLI agents — there's no browser session to draw an identity token from. Linking your enterprise identity once lets AIControls hold a refreshable ID token for you, so PAT-authenticated calls to Cross-App Access servers work without a browser round-trip on every request.
This only applies if your workspace has enterprise SSO configured. If you don't see the Enterprise identity card described below, your workspace doesn't have Cross-App Access datasources or SSO isn't enabled — ask your admin.
Link your identity
Go to Connected Accounts in the builder portal.
At the top of the page, find the Enterprise identity card and click Connect your identity.
Sign in with your enterprise identity provider when prompted. This is the same IdP your workspace uses for portal SSO.
You're redirected back to Connected Accounts with the card now showing Linked.
Once linked, any PAT-authenticated call to a Cross-App Access datasource — from Claude Code or another tool — can complete the identity exchange using your linked identity. AIControls refreshes the underlying token automatically; you won't be prompted again unless you unlink or your access is revoked at the IdP.
Unlink your identity
Click Unlink on the Enterprise identity card and confirm. Cross-App Access datasources stop working for your PAT-authenticated calls until you link again — this doesn't affect access from a live browser session, which already carries its own identity token.
Admins: link your own identity to test Cross-App Access
The Connected Accounts page and the Enterprise identity card work the same way for an admin portal session as they do for a developer — link your identity here using the steps above, from your own admin login.
Once linked, Test connection in the Add/Edit MCP Server drawer uses your linked identity to run the real two-leg ID-JAG exchange against a Cross-App Access server, instead of falling back to a discovery token. This lets you validate a new Cross-App Access datasource's IdP/resource endpoint configuration end-to-end before any developer relies on it.
Troubleshooting
| Symptom | Cause |
|---|---|
| No Enterprise identity card on Connected Accounts | Enterprise SSO isn't configured for your workspace, or there are no Cross-App Access datasources |
| Tool call still fails after linking | The Cross-App Access datasource's IdP/resource audience configuration may not match your linked identity — check with your admin |
| Card shows Not linked again unexpectedly | Your enterprise IdP session was revoked or expired without a refresh token — link again |
IdP shows invalid_redirect_uri / "redirect_uri did not match any of the client's registered redirect_uris" when clicking Connect your identity | Linking your identity uses a different callback URL than the one used for portal SSO login, even though both use the same IdP client registration. Your admin needs to add the identity-link callback URL as an additional registered redirect URI on that client — ask them to check Settings → SSO → User Auth for the exact URL, or reproduce the failed redirect and send them the redirect_uri value shown in the browser's address bar or in the IdP's error page |
| No Sign in with SSO button on the login page (or it fails to open a login screen) | The portal's browser SSO button requires the authorization-code flow. If your workspace's User Auth is configured in device-flow mode (issuer + client ID only, no client secret or redirect URL), there's no browser login endpoint — sign in from the CLI instead (e.g. the start-session flow). To enable the browser button, ask your admin to configure a client secret and redirect URL under Settings → SSO → User Auth |