Enterprise Managed Auth for connectors changedconnectors/building/enterprise-managed-auth
Nearest release: v2.1.301, published 3 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 15 Oct 2026 17:59 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 23 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+10added
Lines−10removed
From line
4
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits8to this page, all time
The whole hunk
from line 4, old and new numbered
/
from line 4
44
55> [!NOTE]
66>
7> Enterprise Managed Auth is available on Claude Team and Enterprise plans. After your authorization server supports it, email `[email protected]` to have [your directory listing](/docs/connectors/building/managing-your-listing.md) marked as supporting Enterprise Managed Auth.
7> Enterprise Managed Auth is available on Claude Team and Enterprise plans. After your authorization server supports it, email `[email protected]` to have [your directory listing](https://claude.com/docs/connectors/building/managing-your-listing.md) marked as supporting Enterprise Managed Auth.
88
99Enterprise Managed Auth (EMA) lets a user connect to your MCP server silently, using the single sign-on session they already have with their organization. Instead of showing each user an OAuth consent screen, Claude presents your authorization server with an identity assertion: a signed JSON Web Token (JWT), issued by the customer's identity provider, that vouches for the user's identity.
1010
from line 24
2424
2525### Enterprise Managed Auth with lazy authentication
2626
27Enterprise Managed Auth also works with [lazy authentication](/docs/connectors/building/lazy-authentication.md). When your server returns `401 Unauthorized` for a protected tool call, Claude normally shows the inline **Connect** card and runs the interactive OAuth flow. If the user's organization has Enterprise Managed Auth configured for your connector, Claude runs the silent JWT bearer exchange instead and retries the tool call without showing a prompt.
27Enterprise Managed Auth also works with [lazy authentication](https://claude.com/docs/connectors/building/lazy-authentication.md). When your server returns `401 Unauthorized` for a protected tool call, Claude normally shows the inline **Connect** card and runs the interactive OAuth flow. If the user's organization has Enterprise Managed Auth configured for your connector, Claude runs the silent JWT bearer exchange instead and retries the tool call without showing a prompt.
2828
29Your MCP server returns the same `401` with a `WWW-Authenticate` header as described in the [lazy authentication guide](/docs/connectors/building/lazy-authentication.md#answer-a-protected-call-with-401-before-the-mcp-sdk-runs). Your authorization server must still meet the [authorization server requirements](#authorization-server-requirements).
29Your MCP server returns the same `401` with a `WWW-Authenticate` header as described in the [lazy authentication guide](https://claude.com/docs/connectors/building/lazy-authentication.md#answer-a-protected-call-with-401-before-the-mcp-sdk-runs). Your authorization server must still meet the [authorization server requirements](#authorization-server-requirements).
3030
3131Enterprise Managed Auth doesn't apply to authless servers. A fully authless server never returns `401`, so there is no point at which Claude can exchange an assertion.
3232
from line 34
3434
3535Before adding Enterprise Managed Auth, make sure the following are already in place:
3636
37* Your MCP server implements [MCP authorization](https://modelcontextprotocol.io/specification/draft/basic/authorization), including Protected Resource Metadata (PRM) discovery, and follows the [MCP security best practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices). See the [authentication guide](/docs/connectors/building/authentication.md) for Claude-specific requirements
38* Your authorization server registers Claude using either [Anthropic-held client credentials](/docs/connectors/building/authentication.md#anthropic-held-client-credentials) or a [Client ID Metadata Document](/docs/connectors/building/authentication.md#dcr-and-cimd-details)
37* Your MCP server implements [MCP authorization](https://modelcontextprotocol.io/specification/draft/basic/authorization), including Protected Resource Metadata (PRM) discovery, and follows the [MCP security best practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices). See the [authentication guide](https://claude.com/docs/connectors/building/authentication.md) for Claude-specific requirements
38* Your authorization server registers Claude using either [Anthropic-held client credentials](https://claude.com/docs/connectors/building/authentication.md#anthropic-held-client-credentials) or a [Client ID Metadata Document](https://claude.com/docs/connectors/building/authentication.md#dcr-and-cimd-details)
3939
4040> [!WARNING]
4141>
from line 133
133133
134134### Provide setup documentation
135135
136You can publish documentation that walks an enterprise administrator through enabling Enterprise Managed Auth for your product and add its URL to [your directory listing](/docs/connectors/building/managing-your-listing.md). Claude shows the link in the Claude admin console when an administrator sets up Enterprise Managed Auth for your connector.
136You can publish documentation that walks an enterprise administrator through enabling Enterprise Managed Auth for your product and add its URL to [your directory listing](https://claude.com/docs/connectors/building/managing-your-listing.md). Claude shows the link in the Claude admin console when an administrator sets up Enterprise Managed Auth for your connector.
137137
138138### Okta Integration Network apps
139139
from line 141
141141
142142## Related resources
143143
144* [Authentication for connectors](/docs/connectors/building/authentication.md): baseline OAuth requirements your server must already meet
145* [Lazy authentication](/docs/connectors/building/lazy-authentication.md): ask users to sign in only when Claude reaches a tool that needs their account
146* [Test your connector](/docs/connectors/building/testing.md): verify your connector works end to end in Claude
147* [Troubleshoot your connector](/docs/connectors/building/troubleshooting.md): diagnose common authentication and connection issues
144* [Authentication for connectors](https://claude.com/docs/connectors/building/authentication.md): baseline OAuth requirements your server must already meet
145* [Lazy authentication](https://claude.com/docs/connectors/building/lazy-authentication.md): ask users to sign in only when Claude reaches a tool that needs their account
146* [Test your connector](https://claude.com/docs/connectors/building/testing.md): verify your connector works end to end in Claude
147* [Troubleshoot your connector](https://claude.com/docs/connectors/building/troubleshooting.md): diagnose common authentication and connection issues
148148
No line in this hunk matches that.