# Supabase — Enterprise-managed auth for MCP: Claude can now issue the identity assertion

- Company: Supabase (supabase.com)
- Announced: 2026-11-03
- Category: capability-change
- Coverage: not counted
- Announcement: yes
- Group: announcements
- Source: https://supabase.com/blog/claude-issued-enterprise-managed-auth-for-mcp
- Record: https://forck.live/items/31159-enterprise-managed-auth-for-mcp-claude-can-now-issue-the-identity-assertion
- Subject: Supabase

Supabase now lets organizations set up enterprise-managed auth for its MCP server even when their identity provider does not support the MCP Enterprise-Managed Authorization extension, because Claude can issue the signed identity assertion instead. The change matters for the many organizations whose providers still lack the extension: Okta was the only identity provider that supported it at launch, and most still do not, so those organizations no longer have to wait. Once a Supabase org owner or admin approves Claude and registers it as the issuer, every member with a matching Supabase SSO identity uses Supabase from Claude with their existing role and no per-member consent screen. Claude signs a short-lived ID-JAG assertion after checking that the person is a current member of the Claude organization and which email address their Claude account uses, but it does not confirm a sign-in at the identity provider, check multi-factor authentication, or apply Supabase's own sign-in rules. Supabase then verifies the signature against the registered issuer, the member's matching SSO identity, and the admin authorization before issuing a short-lived access token bound to that member. Offboarding changes: disabling a member in the identity provider no longer cuts off access, so they must be removed from both the Supabase and Claude organizations, and tokens already issued stay valid until they expire. Supabase trusts one issuer per SSO provider, so the Claude issuer URL replaces the identity provider's URL and Supabase rejects assertions from the old URL until it is restored, including those for other AI tools. Supabase says the feature is generally available to Team and Enterprise organizations with SSO configured, and the Claude auto-connect beta is open to Claude Team and Enterprise organizations, with setup taking about ten minutes if SSO is already configured.

## Evidence

Verbatim from https://supabase.com/blog/claude-issued-enterprise-managed-auth-for-mcp:

> You can now set up enterprise-managed auth for the Supabase MCP server even if your identity provider doesn't support the MCP Enterprise-Managed Authorization extension .
> 
> Claude issues the signed identity assertion that previously had to come from your identity provider. After a Supabase org's owner or admin approves Claude and registers it as the issuer, every member with a matching Supabase SSO identity can use Supabase from Claude with their existing role and no per-member consent screen.
> 
> Availability:
> 
> Supabase: generally available to Team and Enterprise organizations with SSO configured.
> 
> Claude: the Claude auto-connect beta is open to Claude Team and Enterprise organizations. Any Claude admin can turn it on.
> 
> What changed #
> 
> By default, every member signs in with their own Supabase account and approves Claude for an organization through a consent screen. The enterprise-managed auth we launched in August replaces that with one admin approval for organizations that set it up. The identity provider then issues a signed assertion for each member.
> 
> Okta was the only identity provider that supported the extension at launch and most still don't.

---

Record: https://forck.live/items/31159-enterprise-managed-auth-for-mcp-claude-can-now-issue-the-identity-assertion
Catalogue: https://forck.live/llms.txt
Current issue: https://forck.live/feed.md