Enterprise-Managed Authorization for MCP

Enterprise-Managed Authorization for MCP puts your company in charge of which AI tools can connect to Supabase instead of each employee. After the Supabase organization's owner or admin approves Claude, your identity provider or Claude confirms the identity of each employee who uses it. From then on, an employee who signs in to Claude sees Supabase already connected with the role they already have. There is no consent screen to click through and no token to create or share.

Key benefits

1. Approve once: One approval by an owner or admin covers the whole organization. Members never see a consent screen.
2. Same permissions as the Supabase Dashboard: Access is scoped to the signed-in member. A developer gets developer access and a read-only member gets read-only access.
3. No tokens to manage: Access follows the member's sign-in and short-lived tokens expire on their own.
4. Revoke in one place: Revoke Claude for the whole organization under Authorized apps in the Supabase Dashboard. To offboard one member, remove them from your Supabase organization and from your identity provider or Claude organization, whichever one issues their access.
5. No IdP support required: Claude can issue the identity assertion when your IdP cannot.
6. Standards-based: Supabase implements the MCP Enterprise-Managed Authorization extension on top of OAuth. Your security team reviews one open specification and the same setup works across any identity provider or AI tool that adopts it.

When to use it

• Developers share personal access tokens because every Claude connection needs an owner or admin to approve it
• Your security team needs one place to control which AI tools can reach Supabase and which employees can use them

How it works

There are two ways to issue the identity assertion that Claude presents to Supabase:

• Identity provider: Your IdP signs an identity assertion for each member and applies its own policy before issuing one. Okta supports this today and the launch blog post walks through that setup.
• Claude-issued (Claude auto-connect, in beta): Claude signs the assertion for any current member of your Claude organization. Use this when your IdP does not support the extension yet. Nothing changes in your IdP.

A member signs in to Claude and Claude obtains the assertion from the issuer you registered. Supabase verifies the assertion against that issuer, confirms the member belongs to your organization with a matching SSO identity, and issues a short-lived access token bound to that member. When a token expires, Claude repeats the exchange rather than refreshing the token and the member never reconnects by hand.

Get started

Requires a Supabase Team or Enterprise plan with SSO configured and a Claude Team or Enterprise plan. Setup takes about ten minutes once SSO is configured. Your identity provider must issue these identity assertions or Claude issues them for you. Each member must have signed in to Supabase through SSO at least once with the email they use in Claude.

1. Authorize Claude: An owner or admin connects Claude to Supabase and approves it for the organization.
2. Turn on managed authorization in Claude: An admin opens the Supabase connector, turns on managed authorization, and picks the identity source.
3. Register the issuer in Supabase: The same owner or admin opens the SSO page in organization settings, expands Advanced settings, and enters the issuer URL for the identity source picked in step 2.

From then on, every member with a matching Supabase account is connected the next time they use Claude.