Identity and agent access
Supabase MCP with Claude: SSO, permissions and offboarding
Since November 3, Claude can issue identity assertions for Supabase MCP. Review eligibility, permission scope and offboarding before enabling it.
In this article
Managed connection removes individual authorization prompts but changes the identity control point. Define how to remove access in both systems before enabling it.
What the update enables#
On November 3, 2026, Supabase announced that Claude can issue signed ID-JAG assertions when an identity provider does not support the relevant MCP extension. Supabase requires Team or Enterprise with SSO; Claude auto-connect is in beta for Claude Team and Enterprise.
Documentation: Supabase · Claude-issued enterprise-managed auth, 3 November 2026
What each system validates#
Claude checks organization membership and the account email. Supabase validates the signature, matching SSO identity and administrator authorization, then issues a short-lived token with the member’s permissions. This path does not itself verify MFA or a current identity-provider session.
| Situation | What to verify |
|---|---|
| Onboarding | Email and SSO identity match; the role is authorized. |
| Role change | Effective Supabase access matches the intended role. |
| IdP suspension | Do not assume this alone prevents new Claude assertions. |
| Offboarding | Remove the member from Claude and Supabase; account for already-issued tokens. |
Documentation: Supabase · Enterprise-Managed Authorization for MCP
Decide whether to change the issuer#
Supabase accepts one issuer per SSO provider. Registering Claude’s issuer replaces the IdP issuer and can affect other tools using it. If the existing issuer works, inventory its consumers before switching and preserve the configuration required to restore the previous flow.
Documentation: Supabase · Enterprise-Managed Authorization for MCP
An access check in staging#
- Use identifiable test members and staging resources to separate successful connection from correct permissions.
- Test one permitted member and one without matching membership or identity; confirm the latter cannot access resources.
- Check removal in both systems and the lifetime of already-issued tokens. Document responsibility for each offboarding step.
- Review issuer configuration and authorized applications afterward, and record how to restore the previous issuer or revoke the client.
Before enabling the connector, agree who authorizes changes and who removes access; the process must cover the whole organization.