Managed connection removes individual authorization prompts but changes the identity control point. Define how to remove access in both systems before enabling it.
What the update enables#
On November 3, 2026, Supabase announced that Claude can issue signed ID-JAG assertions when an identity provider does not support the relevant MCP extension. Supabase requires Team or Enterprise with SSO; Claude auto-connect is in beta for Claude Team and Enterprise.
Documentation: Supabase · Claude-issued enterprise-managed auth, 3 November 2026 ↗
What each system validates#
Claude checks organization membership and the account email. Supabase validates the signature, matching SSO identity and administrator authorization, then issues a short-lived token with the member’s permissions. This path does not itself verify MFA or a current identity-provider session.
| Situation | What to verify |
|---|---|
| Onboarding | Email and SSO identity match; the role is authorized. |
| Role change | Effective Supabase access matches the intended role. |
| IdP suspension | Do not assume this alone prevents new Claude assertions. |
| Offboarding | Remove the member from Claude and Supabase; account for already-issued tokens. |
Documentation: Supabase · Enterprise-Managed Authorization for MCP ↗
Decide whether to change the issuer#
Supabase accepts one issuer per SSO provider. Registering Claude’s issuer replaces the IdP issuer and can affect other tools using it. If the existing issuer works, inventory its consumers before switching and preserve the configuration required to restore the previous flow.
Documentation: Supabase · Enterprise-Managed Authorization for MCP ↗
An access check in staging#
- Use identifiable test members and staging resources to separate successful connection from correct permissions.
- Test one permitted member and one without matching membership or identity; confirm the latter cannot access resources.
- Check removal in both systems and the lifetime of already-issued tokens. Document responsibility for each offboarding step.
- Review issuer configuration and authorized applications afterward, and record how to restore the previous issuer or revoke the client.
Before enabling the connector, agree who authorizes changes and who removes access; the process must cover the whole organization.
Evidence and scope
Documentation review · Sources reviewed:
Method
Se contrastaron el anuncio del 3 de noviembre y la documentación de autorización MCP de Supabase. La matriz distingue autenticación, permisos y retirada de acceso; la pauta de staging es una propuesta de verificación.
Limitations
- No se configuró ningún conector, emisor, cuenta o permiso. La disponibilidad de Claude auto-connect sigue en beta y depende de la organización.
Next review planned:
Sources and scope
Documentation checked on November 4, 2026. Examples and decision criteria are editorial proposals; adapt them to your application's contract and validate them in an authorized test environment.