Supabase Enables Claude to Issue Identity Assertions for MCP Enterprise Auth
Supabase announces support for Claude as an ID-JAG issuer, allowing enterprises to use centralized AI agent authentication even if their Identity Provider lacks MCP extension support.
On November 3, 2026, Supabase announced that its Model Context Protocol (MCP) server now supports Anthropic's Claude acting as the direct issuer of identity assertions (ID-JAG). Previously, enabling enterprise-managed authorization required the organization's Identity Provider (IdP) to support a specific MCP extension protocol. Since only a few major IdPs like Okta currently offer this capability, this update allows enterprises using other IdPs to implement unified AI agent access control without waiting for vendor upgrades.
Under this mechanism, when a member uses Supabase via Claude, Claude verifies that the user is a current member of the Claude organization and checks their email address, then signs a short-lived identity assertion itself. Supabase validates the signature, confirms SSO identity matching, and checks admin authorization before issuing an access token. This eliminates the need for individual OAuth consent screens for each member, enabling a 'one admin approval, auto-connect for all' experience.
Administrators should note that this change affects offboarding procedures: because neither Claude nor Supabase queries the original IdP for real-time member status, disabling an account in the IdP will not immediately cut off AI agent access. Admins must remove the member from both the Supabase and Claude organizations. Additionally, Supabase trusts only one issuer URL per SSO provider; switching to Claude causes Supabase to reject all assertions signed by the original IdP until the previous URL is restored.