On this page
Supabase change
Claude-issued auth for the Supabase MCP server (November 3, 2026): setup, and why disabling someone in your IdP no longer cuts off access
Short answer
Since November 3, 2026, Claude can sign the identity assertion (ID-JAG) that enterprise-managed authorization for the Supabase MCP server needs, so Claude Team and Enterprise members connect to Supabase without a sign-in or consent screen even when your identity provider does not support the MCP extension. Supabase then trusts Claude instead of your IdP: disabling someone in the IdP no longer cuts off their access, Supabase rejects the IdP's own assertions (including other AI tools'), and tokens already issued stay valid until they expire.
Who can use it
On Supabase it is generally available to Team and Enterprise organizations with SSO configured; on Claude, Claude-issued auth is a beta (the auto-connect beta) open to Team and Enterprise organizations, and Anthropic lists Supabase among its connectors with Amplitude, Atlassian, Datadog, Figma, Linear and Notion. You need a Supabase owner or admin, a Claude organization admin, and members who have signed in to Supabase through SSO at least once with the email they use in Claude. Matching is case-insensitive but does not work with aliases or plus-addresses. Supabase's post says Okta was the only identity provider that supported the extension at launch and most still do not; nothing changes in your IdP. Checked against Supabase's post and setup guide and Anthropic's help article on 2026-11-03.
How Claude-issued auth works
Claude signs a short-lived ID-JAG for each current member of your Claude organization, after checking that the person is a member and which email their Claude account uses. Supabase checks that the signature matches the issuer you registered, that the member belongs to your Supabase organization with a matching SSO identity, and that an owner or admin authorized Claude. It then issues a short-lived access token bound to that member, and Claude asks for a new assertion when the token expires, so members do not reconnect by hand.
Claude does not confirm the sign-in at your IdP, check MFA or apply Supabase's sign-in rules. Anthropic recommends enforcing SSO for your Claude organization but does not require it for this setup.
Set it up in four steps
- 1Approve Claude in Supabase. A Supabase owner or admin connects Claude to the Supabase MCP server through the usual sign-in and approves it on the consent screen; the approval then shows under Authorized apps in the organization settings, where you can review or revoke it.
- 2Pick Claude as the identity source. In Claude, open Organization settings > Connectors, select the Supabase connector, and on the Configuration tab click Set up next to Managed authorization. In the Connect step, set Identity source to Claude-issued, copy the Issuer URL, which is unique to your Claude organization, and leave Tenant ID empty.
- 3Register the issuer in Supabase. Read the traps below first, then in the Supabase Dashboard open the SSO page, expand Advanced settings, paste the URL into the ID-JAG Issuer field and save. If you are not an owner or admin of the Supabase organization, use Send to an admin in Claude.
- 4Test and enable. In Claude, click Run test and confirm every check passes, including Exchange for access token and Probe connector, and that the authorization server shown is https://api.supabase.com; if a check fails, correct the issuer URL and click Run again. Then click Enable and continue and finish the Roles and Scopes steps: every role gets managed authorization by default, so pick the roles that should connect automatically.
What changes once Claude is the issuer
From Supabase's post and setup guide and Anthropic's help article, read on 2026-11-03.
Disabling someone in your IdP no longer cuts off access
Neither Claude nor Supabase asks your IdP whether the member is still active. To remove a member, remove them from both your Supabase organization and your Claude organization. With SCIM directory sync, Claude removes a member when your directory deletes them, but not when it only suspends them or marks them inactive.
Your IdP's own assertions are rejected, including other AI tools'
Supabase trusts one issuer URL per SSO provider. Entering the Claude URL replaces your IdP's URL, and Supabase rejects every ID-JAG your IdP issues until you restore it, so any other AI tool that used your IdP for managed authorization loses access in the meantime. List those tools before you save the Claude URL.
One Supabase organization per issuer URL
Each issuer URL can serve only one Supabase organization, and Claude's issuer URL is unique to your Claude organization.
Tokens already issued stay valid until they expire
Removing a member only stops new grants. An access token Supabase already issued keeps working until it expires, and neither source gives its lifetime.
A reused email signs in as the old member
Before you give a former member's email address to someone new, remove the former member from your Supabase organization. Otherwise the new person is signed in as the old member.
Related guides
Official docs behind this checklist
Browse all launch guides · Read resources · How to make and check your next change
FAQ for builders before launch
Do I still need an identity provider that supports the MCP extension?
No. That is the change: Claude signs the assertion instead. Your Supabase organization still needs SSO configured, and nothing changes in your identity provider.
Will members see a sign-in or consent screen?
No. Members in the roles you selected see Supabase already connected in Claude. A member with no matching Supabase account sees the normal Connect prompt.
How do I switch back to my IdP?
Put your IdP's issuer URL back in the ID-JAG Issuer field. Supabase rejects your IdP's assertions only until you restore it.
Does it work on the Supabase Free or Pro plan?
No. Supabase's guide says the feature is only available on the Team and Enterprise plans.