Image: The New Stack
Why it mattersA team held back on Claude plugins because its identity provider lacked the right extension. It can now turn them on, at the cost of split offboarding.
A company wants to roll out Claude's MCP plugins to staff. Until this week, every employee had to sign in to every plugin by hand. One-click rollout for the whole organization only worked with one specific extension in the company's identity provider. Anthropic says Claude itself can now sign that check instead.
The feature is called Claude-issued auth. It builds on the Enterprise-Managed Authorization extension to the Model Context Protocol. Anthropic released that extension earlier this year. When it first launched, Okta was the only identity provider that supported it. Supabase, writing about the new feature on 3 November, says "most still don't". A company on one of those providers had no central way to connect Claude to its work tools. Claude-issued auth, released on 3 November in beta for Claude Team and Enterprise plans, removes that condition.
The two checks Claude runs
Anthropic's help article says Claude signs the assertion after checking two things. The person is a current member of the Claude organization. The email address on their Claude account is the one the admin registered. The Supabase post, naming the token the ID-JAG, draws the limits of that check. Claude's signature stands only for current organization membership and the registered email. A sign-in at the company's identity provider sits outside that check. So does multi-factor authentication and the connected service's own sign-in rules. Admins who want those enforced have to keep the identity-provider path.
The receiving service runs three checks of its own. The signature has to match the issuer the admin registered. The member has to belong to the Claude organization and have a matching SSO identity in the service. An admin at the service has to have authorized Claude. If all three pass, the service issues a short-lived access token for that employee. The member never reconnects by hand.
Fourteen services at launch
The New Stack lists 14 services supporting Claude-issued auth from day one. They are Amplitude, Apollo.io, Atlassian, Datadog, Dropbox, Figma, Granola, HubSpot, Linear, Mixpanel, Notion, PagerDuty, Semrush, and Supabase. Boris Cherny, head of applications at Anthropic, announced the feature on X on 3 November. He wrote that "signing in to your company's plugins one by one is annoying". Supabase, writing on the same day, says setup takes about ten minutes if single sign-on is already in place. Each Claude organization gets a unique issuer URL.
The offboarding trade
Supabase states the trade-off plainly. Disabling a member in the company's identity provider no longer cuts off their access. Neither Claude nor the connected service asks the identity provider whether the member is still active. To remove a member now, the admin has to remove them from both the Claude organization and the connected service. Tokens already issued stay valid until they expire.
A team that already has a working identity-provider path does not need to switch. Supabase says "nothing changes for you" if the identity provider already issues the assertion. The existing issuer URL stays in place. The point of the new path is that the wait is now optional.
For a team building the MCP server on the other side of the connection, the offer is simpler. Anthropic's docs invite developers of connectors to add support "so users get started faster and stay connected without re-authorizing". That leaves identity-provider work out of the first version.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
