From the Anthropic edition of November 4, 2026
Supabase: using Claude as identity issuer breaks IdP-based offboarding and can lock out other AI tools that rely on the existing issuer
Supabase · Database platform; Claude connector partner · Global
- Publisher
- Supabase blog
- Original publication
- November 3, 2026
- Source retrieved
- 2026-11-05
- Event date
- 2026-11-03
What happened
Supabase describes the Claude-issued enterprise-managed auth flow for its MCP server: after an admin registers Claude's organization issuer URL, members with matching SSO identities connect from Claude without consent screens. Supabase states that Claude checks organization membership but not IdP sign-in, MFA or Supabase rules; that disabling a member in the identity provider no longer cuts off access, so removal is required in both Claude and Supabase; that issued tokens remain valid until expiry; and that replacing the IdP issuer URL with Claude's makes Supabase reject assertions from the IdP, including for other AI tools. Supabase says Okta was the only IdP supporting the extension at launch.
Why it matters
Relevant to university research computing and state or municipal developer teams using Supabase or similar MCP-connected platforms with Claude. The constraints are the transferable lesson: adopting Claude as issuer changes offboarding and can break other AI integrations. Why now: published Nov. 3 alongside the Claude auto-connect beta.
Evidence and measured results
Vendor technical description; no measured results.
Limitations and uncertainty
Specific to Supabase; partner-promotional.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Developer and research teams want Claude connected to their database platform without per-user consent, but the identity trade-offs are not obvious.
- Stakeholders
- Research computing director
- Application development manager
- Identity lead
- CISO
- Discovery questions
- Does your IdP already support MCP enterprise-managed authorization?
- What other AI tools connect to the same Supabase organization?
- How fast must access end after offboarding?
- Value hypothesis
- Interpretation: smoother Claude access for developers where the IdP cannot issue assertions, with explicit offboarding controls.
- Potential engagement
- An architecture review of MCP authorization choices for one Supabase organization.
- Unsupported claims
- IdP-equivalent security
- No impact on other AI tools
- Immediate revocation on offboarding
Pre-sales engineering
Role takeaway
- Fit
- Supabase organizations with SSO and Claude Team or Enterprise.
- Architecture and integration
- Approve Claude in Supabase, register the Claude issuer URL in the ID-JAG Issuer field, test, then set roles and scopes in Claude.
- Prerequisites
- Supabase SSO configured
- Members signed in once via SSO with matching email
- Admins in both systems
- Constraints
- One issuer per SSO provider
- Rejects IdP-signed assertions after switch
- One Supabase organization per issuer URL
- Security
- No MFA or IdP check at assertion time; tokens valid until expiry; dual removal required.
- Proof of value
- Verify other MCP clients still work after switch
- Measure time to revoke after removal
- Confirm Supabase role inheritance
Delivery
Role takeaway
- Work
- Assess, then if approved switch issuer in a non-production Supabase organization first.
- Dependencies
- Identity team
- All AI tool owners on the organization
- Supabase admin
- Ownership
- Research computing or application platform team
- Skills and adoption
- Admins learn ID-JAG issuer setup; none for end users.
- Governance checkpoints
- Change-control approval
- Offboarding runbook update
- Rollback plan to IdP issuer
- Acceptance criteria
- Proposal: no other AI integration breaks in staging test
- Proposal: documented revocation within token lifetime
- Risks
- Breaking other AI tools
- Residual access after offboarding
- Misconfigured issuer across organizations
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
One issuer per SSO provider in Supabase: choosing Claude displaces the IdP issuer for all MCP clients.
Governance
Who approves, reviews and stays accountable for outcomes?
Change control should treat issuer switches as identity architecture changes affecting other tools.
Security and privacy
What data, permissions and controls need testing?
Offboarding no longer flows from the IdP; residual tokens persist until expiry.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Limited.
Procurement
What should contracts, pricing and exit terms secure?
Limited; confirm partner terms for MCP access.
Operating model
Which teams own the service once it runs?
Identity owners must coordinate with research and dev teams before switching issuers.
Publication history
- 2026-11-04Anthropic · Issue 074 resources
Stable resource ID: supabase-claude-issued-auth-offboarding-and-issuer-tradeoffs-20261103