Auth for GenAI

Verification notes: Re-checked this pass: no material change to MCP support or evidence found; XAA (Cross App Access) remains pre-GA for Auth0, with native support for Requesting Apps anticipated 'by August 31, 2026' through Token Vault per Auth0's own blog — worth a follow-up check after that date in case Auth0 reframes XAA as A2A-adjacent, though XAA and A2A remain distinct protocols today. Earlier correction, still standing: Auth0's 'Auth for MCP' reached general availability on May 6, 2026 — confirmed directly via Auth0's own blog — adding OAuth 2.1/OIDC authentication, Client ID Metadata Document (CIMD) client registration, and On-Behalf-Of token exchange specifically for securing MCP servers and clients. That's explicit, documented MCP support, so the mcp flag moves from false to true (was incorrectly left false in earlier passes). Token Vault (delegated API access via short-lived tokens) remains limited to Public Cloud tenants. Auth0 publishes an open-source reference implementation at github.com/auth0/auth-for-genai, though the core Auth0 service itself is not open source. For a differently-scoped approach to a related problem — brokering credentials to agents without exposing the secret value, rather than issuing signed tokens — see the newly added 1Password Unified Access listing. Correction this pass: the anticipated XAA GA did not fully land on schedule. Auth0's own August 6, 2026 blog post carried an explicit forward-looking-statement disclaimer around native Requesting App support via Token Vault, and it shipped only as early access on August 31, 2026, not full GA — a full GA date is still unconfirmed via Auth0's own changelog. Separately, Okta's own August 24, 2026 GA press release for Agent SSO confirms XAA is now formally the official 'Enterprise-Managed Authorization' extension of MCP, not an A2A mechanism — reinforcing that a2a=false remains correct here. See the updated Okta for AI Agents listing for the Agent SSO details.