Supabase lets Claude vouch for your identity on its MCP server
Claude can now issue the identity assertion enterprise SSO needs for Supabase MCP access, skipping identity providers that do not support the spec yet, but offboarding works differently.
Supabase announced on 3 November that Claude can now issue the identity assertion its MCP server needs for enterprise-managed authentication, instead of waiting on your identity provider to support it. Most identity providers, Okta being the exception Supabase names, do not yet implement the MCP specification’s Enterprise-Managed Authorization extension.
Setup takes about ten minutes: an admin approves Claude as a connector in Supabase, sets the identity source to “Claude-issued”, and registers the resulting issuer URL in Supabase’s SSO settings. After that, Claude checks that a user is a current organisation member, signs an identity assertion (an ID-JAG, as defined in the MCP spec), and Supabase verifies the signature and the member’s SSO identity before issuing a short-lived, auto-renewing access token. Every matching member can then use the Supabase MCP server under their existing role with no per-member consent screen.
Why it matters: if you are rolling out Supabase’s MCP server to a team whose identity provider does not support the extension, this removes the wait, at the cost of a different trust boundary: Claude, not your IdP, is now vouching for who your employees are.
The caveat: Supabase confirms that disabling someone in your identity provider does not revoke their Claude-issued access, since neither side checks IdP status anymore. You have to remove the person from both the Supabase and Claude organisations to cut them off, which is an easy step to miss during offboarding.