From the source
Supabase now lets organizations set up enterprise-managed auth for its MCP server even when their identity provider does not support the MCP Enterprise-Managed Authorization extension, because Claude can issue the signed identity assertion instead.
- The change matters for the many organizations whose providers still lack the extension: Okta was the only identity provider that supported it at launch, and most still do not, so those organizations no longer have to wait.
- Once a Supabase org owner or admin approves Claude and registers it as the issuer, every member with a matching Supabase SSO identity uses Supabase from Claude with their existing role and no per-member consent screen.
- Claude signs a short-lived ID-JAG assertion after checking that the person is a current member of the Claude organization and which email address their Claude account uses, but it does not confirm a sign-in at the identity provider, check multi-factor authentication, or apply Supabase's own sign-in rules.
- Supabase then verifies the signature against the registered issuer, the member's matching SSO identity, and the admin authorization before issuing a short-lived access token bound to that member.
- Offboarding changes: disabling a member in the identity provider no longer cuts off access, so they must be removed from both the Supabase and Claude organizations, and tokens already issued stay valid until they expire.
- Supabase trusts one issuer per SSO provider, so the Claude issuer URL replaces the identity provider's URL and Supabase rejects assertions from the old URL until it is restored, including those for other AI tools.
