Claude-issued auth beta: sign in to Claude and your company's plugins and MCP connectors are already connected
What is it?
When a Team or Enterprise admin picks "Claude-issued" as a connector's identity source, Claude sends the MCP server a signed identity assertion under an issuer URL unique to that organization. Once an admin of the connected service registers that URL as a trusted issuer, members are connected the first time they use the plugin, with no sign-in page or consent screen. Users are matched by email, so no identity provider or SSO is required. On the server side, the token endpoint has to accept the JWT bearer grant (RFC 7523).
Why does it matter?
It removes the most tedious part of rolling plugins out across a company: making every person go through their own OAuth login. If you build an MCP server, enabling the urn:ietf:params:oauth:grant-type:jwt-bearer grant and adding a per-workspace issuer setting gives you a connector that works out of the box for Claude's enterprise customers. Claude only checks organization membership, though, not SSO or MFA, so get your security team to review it.
Maturity
BetaIt's in beta. It only works with connectors whose provider supports Claude-issued auth, and clients registered through Dynamic Client Registration (DCR) can't use it.
How to track it
- Supported connectors: Watch how the list of supported connectors in the Help Center guide grows.
- General availability: Check the Claude release notes for when the beta label comes off and whether more plans get it.
- Security controls: Follow the admin guide for new controls on the risks it flags, such as access a departed employee was already granted.