---
title: "Enterprise-managed auth for the Supabase MCP server"
description: "Supabase has generally released enterprise-managed authentication for its MCP server on Supabase Team and Enterprise plans, built with Anthropic and Okta. The change moves authorization for using Supabase in Claude to the organization's identity provider: an administrator authorizes the connector once, while employees receive access according to their existing Supabase projects and permissions. Each query and management action runs with the individual employee's current role, so developers and read-only members do not receive more access than they have in Supabase directly. Okta groups can restrict access, and onboarding, offboarding, and access reviews can be handled through existing identity-provider workflows rather than individual OAuth approvals; availability requires Okta SSO plus a Claude Team or Enterprise plan, with SCIM provisioning listed as a future roadmap item."
---

# Enterprise-managed auth for the Supabase MCP server

[Supabase](https://yomu.fyi/company/supabase) · cemal\_kilic, gregnr · Aug 24, 2026

**Type:** Announcement

## Summary

Supabase has generally released enterprise-managed authentication for its MCP server on Supabase Team and Enterprise plans, built with Anthropic and Okta. The change moves authorization for using Supabase in Claude to the organization's identity provider: an administrator authorizes the connector once, while employees receive access according to their existing Supabase projects and permissions. Each query and management action runs with the individual employee's current role, so developers and read-only members do not receive more access than they have in Supabase directly. Okta groups can restrict access, and onboarding, offboarding, and access reviews can be handled through existing identity-provider workflows rather than individual OAuth approvals; availability requires Okta SSO plus a Claude Team or Enterprise plan, with SCIM provisioning listed as a future roadmap item.

## Context

Before this change, each person connecting Claude to Supabase approved their own OAuth consent, and only organization owners could authorize the connection at all.

## Approach / What changed

An administrator authorizes the Supabase connector once through the organization's identity provider. Employees then use Supabase in Claude with the projects and permissions already assigned to them, while Okta groups and existing onboarding, offboarding, and access-review workflows manage access centrally.

## Takeaways

- Enterprise-managed auth is available to Supabase Team and Enterprise organizations with Okta SSO enabled and a Claude Team or Enterprise plan.
- Access is tied to each employee's existing Supabase role and project permissions; every query and management action uses that role.
- Okta groups can restrict access, while offboarding in Okta removes the person's Supabase access in Claude; SCIM provisioning is on the roadmap.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Onboarding](https://yomu.fyi/topic/onboarding)

- Source: [Supabase](https://supabase.com/blog/enterprise-managed-auth-for-the-supabase-mcp-server)
- Source URL: https://supabase.com/blog/enterprise-managed-auth-for-the-supabase-mcp-server
- Ingested by Yomu: 2026-08-30T12:47:25.920Z

[Read original post](https://supabase.com/blog/enterprise-managed-auth-for-the-supabase-mcp-server)