One read of Claude Documentationclaude-docs-20261105T030705Z
3 pages moved out of 281 read.
Pages moved
3
significant first
Pages read
281
in this capture
Captured
03:07 UTC
Corpus hash
addca38fc902
corpus-hash
What this read moved
1-3 of 3connectors/building/authentication Changed · +4 / -4 lines
from line 22
2222> [!NOTE]
2323>
2424> * If some of your tools work without the user's account, see [Lazy authentication](https://claude.com/docs/connectors/building/lazy-authentication.md) to let people use those right away and sign in only when Claude reaches a tool that needs their account
25> * If you want enterprise users to connect through their organization's SSO without a consent screen, see [Enterprise Managed Auth](https://claude.com/docs/connectors/building/enterprise-managed-auth.md)
25> * If you want to support auto-connect, so that an organization's users connect without a consent screen, see [Enterprise Managed Auth](https://claude.com/docs/connectors/building/enterprise-managed-auth.md)
2626
2727Use this page to [pick an authentication type](#supported-authentication-types), [register Claude as an OAuth client](#register-claude-as-an-oauth-client), [make discovery and redirects work](#oauth-discovery-and-redirect-uris), and [meet the token endpoint requirements](#token-endpoint-requirements).
2828
from line 238
238238
239239## Enterprise and custom connector authentication
240240
241You don't need a separate OAuth application for each enterprise customer, but a customer's organization can supply its own OAuth client or connect its users through SSO without a consent screen.
241You don't need a separate OAuth application for each enterprise customer, but a customer's organization can supply its own OAuth client or connect its users without a consent screen.
242242
243243### Enterprise authentication
244244
245245Unless your listing asks for credentials at connection time, enterprise customers connect through the same OAuth application as everyone else. Scope what each user can reach with your service's own per-user permissions rather than with a per-tenant OAuth app. These cases work differently:
246246
247* **SSO without a consent screen**: organizations using SSO can connect their users with an identity assertion signed by their identity provider instead of an interactive OAuth consent step. See [Enterprise Managed Auth](https://claude.com/docs/connectors/building/enterprise-managed-auth.md) for what your authorization server needs to support
247* **Auto-connect**: an organization can connect its users with an identity assertion signed by its identity provider or by Claude instead of an interactive OAuth consent step. See [Enterprise Managed Auth](https://claude.com/docs/connectors/building/enterprise-managed-auth.md) for what your authorization server needs to support
248248* **Customer-supplied OAuth client**: a listing that asks for [credentials entered at connection time](#credentials-entered-at-connection-time) has each customer supply its own OAuth client, and an administrator who adds your server as a [custom connector](#custom-connectors) can enter one too
249249
250250### Custom connectors
from line 262
262262## Next steps
263263
264264* [Lazy authentication](https://claude.com/docs/connectors/building/lazy-authentication.md): let people use the tools that don't need their account right away, and ask them to sign in only when Claude reaches one that does
265* [Enterprise Managed Auth](https://claude.com/docs/connectors/building/enterprise-managed-auth.md): accept identity assertions from enterprise SSO instead of an interactive consent step
265* [Enterprise Managed Auth](https://claude.com/docs/connectors/building/enterprise-managed-auth.md): support auto-connect by accepting identity assertions from a customer's identity provider or from Claude instead of an interactive consent step
266266* [Test your connector](https://claude.com/docs/connectors/building/testing.md): add your server as a custom connector and exercise the auth flow
267267* [Troubleshoot your connector](https://claude.com/docs/connectors/building/troubleshooting.md): diagnose "Couldn't reach the MCP server" and "Authorization with the MCP server failed"
268268
connectors/building/index Changed · +1 / -1 lines
from line 44
4444If you need one of these related flows, follow its page:
4545
4646* **[Lazy authentication](https://claude.com/docs/connectors/building/lazy-authentication.md)**: if some of your tools work without the user's account, people can use those right away and sign in only when Claude reaches a tool that needs it
47* **[Enterprise Managed Auth](https://claude.com/docs/connectors/building/enterprise-managed-auth.md)**: lets enterprise users connect through their organization's SSO without a consent screen
47* **[Enterprise Managed Auth](https://claude.com/docs/connectors/building/enterprise-managed-auth.md)**: support auto-connect, so an organization can connect its users without a consent screen
4848
4949### Decide what the server exposes
5050
connectors/building/lazy-authentication Changed · +1 / -1 lines
from line 314
314314## Next steps
315315
316316* [Authentication for connectors](https://claude.com/docs/connectors/building/authentication.md): check the OAuth requirements your authorization server must meet, including redirect URIs and token refresh
317* [Enterprise Managed Auth](https://claude.com/docs/connectors/building/enterprise-managed-auth.md): let organizations with SSO answer the same `401` with a silent token exchange
317* [Enterprise Managed Auth](https://claude.com/docs/connectors/building/enterprise-managed-auth.md): let Claude answer the same `401` with a silent token exchange for organizations that set up auto-connect for your connector
318318* [Test your connector](https://claude.com/docs/connectors/building/testing.md): expose the server through a tunnel and add it as a custom connector
319319* [Troubleshoot your connector](https://claude.com/docs/connectors/building/troubleshooting.md): diagnose discovery and authorization failures
320320