--- title: Enterprise-Managed Authorization for Linear with Okta product: vercel url: /docs/connect/ema/linear canonical_url: "https://vercel.com/docs/connect/ema/linear" last_updated: 2018-10-20 type: how-to prerequisites: - /docs/connect/ema - /docs/connect related: - /docs/connect/ema summary: Configure Enterprise-Managed Authorization (EMA) with Okta and Linear so your app can access the Linear MCP server through Vercel Connect. install_vercel_plugin: npx plugins add vercel/vercel-plugin --- # Enterprise-Managed Authorization for Linear with Okta Use Enterprise-Managed Authorization (EMA) to access the Linear Model Context Protocol (MCP) server after Okta sign-in, without a separate Linear consent prompt. Enable EMA in Vercel Connect and Linear, and configure cross-app access (XAA) in Okta. See [how EMA uses XAA](/docs/connect/ema#ema-and-cross-app-access). Linear supports EMA for eligible MCP clients. Confirm that Linear accepts your Connect-managed OAuth client before using this setup in production. Enabling EMA on the connector doesn't replace Linear's client and workspace requirements. ## Prerequisites - A Linear Enterprise workspace with SAML single sign-on (SSO) through the [Linear integration in the Okta Integration Network (OIN)](https://linear.app/docs/saml-and-access-control#oin-integration-for-saml). A custom SAML integration alone doesn't support MCP EMA. - A Linear workspace administrator and Okta super admin to complete setup. - A user who can sign in to the intended Linear workspace through Okta. - An [identity provider (IdP) connector configured for EMA](/docs/connect/ema#configure-your-identity-provider), with an active Okta AI agent linked to its OpenID Connect (OIDC) application. ## Enable EMA for your Linear workspace 1. Open Linear's **Settings** > **Administration** > **Security**, then **Authentication methods** > **SAML & SCIM**. 2. Edit the Okta identity provider and enable **MCP enterprise managed authentication**. 3. Set **Issuer URL** to your Okta org URL, such as `https://your-org.okta.com`, and save. Use the same Okta issuer as your IdP connector, not the Linear MCP URL. ## Create the Linear MCP connector Create an OAuth connector in Vercel Connect using managed setup. Enter `https://mcp.linear.app/mcp` as the service URL and complete creation. In the connector's **Settings**, enable **Enterprise-Managed Authorization (EMA)** in **Resource** mode and configure: | Field | Value | | --- | --- | | Audience | `https://mcp.linear.app` | | Resource | `https://mcp.linear.app/mcp` | The audience identifies Linear's authorization server. The resource identifies its MCP endpoint. Don't use your Okta org URL for either field. Under **Grant Types** > **User Authorization**, enable user authorization and select the scopes your app needs. Save your changes. Copy the connector's provisioned **Client ID** for Okta. If it's a client metadata URL, copy the entire URL. Don't substitute the connector UID or your Okta application's client ID. ## Connect the Okta agent to Linear 1. Open the Linear OIN application integration for your workspace in Okta. Under **Machine Assignments** > **Callers**, enable **Cross App Access (XAA)**. Older versions call this tab **Resource Server**. 2. Verify its **Issuer URL** is `https://mcp.linear.app`. OIN integrations supply vendor-managed issuer and scope definitions. Match any required tenant identifier to your Linear workspace. 3. Go to **Directory** > **AI Agents**, select your agent, and open **Resource connections**. 4. Select **Add resource connection** and configure: | Field | Value | | --- | --- | | Application instance | Your workspace's XAA-enabled Linear OIN integration | | Agent client ID registered in Linear | The complete Client ID from your Connect connector | | Resource identifier | `https://mcp.linear.app/mcp` | | Scopes | Allow all scopes, or any valid set of scopes | Save the connection. See [Okta's AI agent-to-app guide](https://developer.okta.com/docs/guides/xaa-agent-to-app/main/#configure-the-xaa-connection) for the full workflow. ## Request a Linear token Enable EMA **Identity Provider (IdP)** mode on the Okta connector and **Resource** mode on Linear. Link both connectors to your project and environment. Follow the [Passport flow](/docs/connect/ema#use-ema-with-passport), then use the [resource token example](/docs/connect/ema#request-a-resource-token) with: | Parameter | Example | | --- | --- | | Resource connector UID | `oauth/linear` | | `scopes` | `['read']` | Replace the UID and example scopes with your own, and pass the Passport identity as `subject`. For apps without Passport, follow the [custom integration flow](/docs/connect/ema#custom-integrations-without-passport). Set `subject.experimental_idp` to your Okta connector's UID, such as `oauth/okta`, and use the same application user ID as the IdP sign-in. Use the returned token for server-side requests to `https://mcp.linear.app/mcp`. This guide covers MCP access, not Linear's GraphQL API. Validate with a user and connector that have no separately authorized Linear token, so a cached OAuth token doesn't mask a failed EMA exchange. ## Troubleshoot access | Symptom | What to check | | --- | --- | | EMA settings unavailable in Linear | Configure SAML through the Linear OIN integration, not only a custom SAML app. | | Client registration or token exchange rejected | Confirm Linear accepts the OAuth client for EMA and that Okta uses its complete Client ID. Check the audience, resource identifier, and workspace. | | `UserAuthorizationRequiredError` | Check the stored IdP refresh token, both connectors' EMA modes, project links, and Okta resource connection. Follow the [authorization recovery steps](/docs/connect/ema#handle-authorization-failures). | | Scope-related errors | Match the scopes in your request, connector configuration, and Okta resource connection. | ## Reference documentation - [Okta: Implement XAA token exchange](https://developer.okta.com/docs/guides/xaa-request-token-ex/openidconnect/main/) - [Linear: Enterprise-managed authorization](https://linear.app/docs/mcp#enterprise-managed-authorization) - [Linear: SAML configuration](https://linear.app/docs/saml-and-access-control) --- [View full sitemap](/docs/sitemap) If you find anything wrong or missing or can't find something, submit feedback by reading https://vercel.com/feedback.md to improve Vercel.