Team sign-in for Claude Team and Enterprise

With team sign-in, the members of your Claude organization use TerraLab in Claude without signing in to TerraLab each time. Claude vouches for the member with a signed identity assertion, and TerraLab answers with an access token for that member's account. This is Enterprise Managed Auth, from the MCP enterprise-managed authorization extension.

It needs a Claude Team or Enterprise plan and an Owner or Primary Owner of the Claude organization. Claude Pro and Free accounts, ChatGPT and other agents keep the normal sign-in described in Authentication.

What each side does

The admin and the owner can be the same person.

1. Add TerraLab to your Claude organization

In Claude, open Admin settings, Connectors, and add TerraLab with the server URL:

https://mcp.terra-lab.ai/mcp

Open the connector. In its Authentication section, click Set up on the Managed authorization row and choose Claude-issued under Identity source. Claude shows an Issuer URL of the form https://identity.anthropic.com/issuers/<issuer-id>. Copy it exactly.

2. Create your TerraLab team

1. Sign in at terra-lab.ai/login with the account that owns the team.
2. Open Dashboard, MCP and unfold Team sign-in for Claude Team and Enterprise.
3. Paste the issuer URL in Trusted issuer URL, tick Turn on team sign-in and click Save.
4. Copy the Tenant ID shown under the form and paste it in the Tenant ID field of Claude's managed authorization setup. It is optional but recommended: it ties Claude's assertions to your team. Without it, TerraLab picks the team the member accepted; it is required only when one email has accepted several teams that trust the same issuer.

3. Invite your members

Add each member's email under Members: the address of their Claude account. Each member then signs in to terra-lab.ai with that email, opens Dashboard, MCP and clicks Accept under Team invitations. A member without a TerraLab account creates one by signing in.

From then on, the member's Claude connects to TerraLab on its own and renews access every hour without asking.

The acceptance step is deliberate: an issuer URL is not a secret, so TerraLab never lets a team act for an account that did not agree to join it. The invitation shows the issuer URL, and the acceptance holds for that issuer only.

4. Test the connection

In Claude's managed authorization setup, click Run test under Connection status. A member who has not accepted yet gets invalid_grant with the reason in the description.

Usage and billing

Each member's calls count against that member's own TerraLab account: 100 free calls a month, then their balance. See Pricing.

Remove access

Changing the issuer URL also ends every access issued under the old one, and every member must accept again. When someone leaves your Claude organization, Claude stops vouching for them at once; remove them here too.

For identity providers

An identity provider that issues ID-JAG assertions (for example Okta Cross App Access) works the same way: paste its issuer URL instead of Claude's. TerraLab finds the member by the email claim, so the provider must send it.