Enterprise-managed auth for the Supabase MCP server

Summary

Supabase has generally released enterprise-managed authentication for its MCP server on Supabase Team and Enterprise plans, built with Anthropic and Okta. The change moves authorization for using Supabase in Claude to the organization's identity provider: an administrator authorizes the connector once, while employees receive access according to their existing Supabase projects and permissions. Each query and management action runs with the individual employee's current role, so developers and read-only members do not receive more access than they have in Supabase directly. Okta groups can restrict access, and onboarding, offboarding, and access reviews can be handled through existing identity-provider workflows rather than individual OAuth approvals; availability requires Okta SSO plus a Claude Team or Enterprise plan, with SCIM provisioning listed as a future roadmap item.

Takeaways

1. 1

   Enterprise-managed auth is available to Supabase Team and Enterprise organizations with Okta SSO enabled and a Claude Team or Enterprise plan.

2. 2

   Access is tied to each employee's existing Supabase role and project permissions; every query and management action uses that role.

3. 3

   Okta groups can restrict access, while offboarding in Okta removes the person's Supabase access in Claude; SCIM provisioning is on the roadmap.