Supabase lets Claude issue identity assertions for enterprise-managed MCP auth

Previously, the signed identity assertion had to come from the organization's identity provider, and Okta was the only provider supporting the extension at launch. With Claude as the issuer, members with a matching Supabase SSO identity can use Supabase from Claude with their existing role and without a per-member consent screen. Claude checks that the person is a current member of its organization and which email address their Claude account uses, but it does not confirm the identity provider sign-in or apply Supabase's own sign-in rules.

Supabase checks the assertion signature, the registered issuer, SSO membership in the organization, and that an owner or admin has authorized Claude. If these pass, Supabase issues a short-lived access token for the member, and Claude renews the assertion when it expires. Supabase is generally available to Team and Enterprise organizations with SSO configured, and the Claude auto-connect beta is open to Claude Team and Enterprise organizations.

Teams on identity providers without the extension can now use managed authorization for the Supabase MCP server without changing their identity provider.

Offboarding changes: disabling a member in the identity provider no longer revokes access, so the member must be removed from both the Supabase and Claude organizations, and already issued tokens stay valid until they expire.

Supabase trusts one issuer per SSO provider, so replacing the identity provider's issuer URL with the Claude URL causes Supabase to reject that provider's assertions, including those used by other AI tools.