# Team sign-in for Claude Team and Enterprise

> Index of the TerraLab docs for agents: [llms.txt](https://terra-lab.ai/docs/llms.txt). Every docs page is also served as markdown: add .md to its URL.

With team sign-in, the members of your Claude organization use TerraLab in Claude without signing in to TerraLab each time. Claude vouches for the member with a signed identity assertion, and TerraLab answers with an access token for that member's account. This is Enterprise Managed Auth, from the [MCP enterprise-managed authorization extension](https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization).

It needs a Claude Team or Enterprise plan and an Owner or Primary Owner of the Claude organization. Claude Pro and Free accounts, ChatGPT and other agents keep the normal sign-in described in [Authentication](https://terra-lab.ai/docs/authentication).

## What each side does

| Who | Does what | Where |
| --- | --- | --- |
| Claude admin | Adds TerraLab, turns on managed authorization, copies the issuer URL | Claude admin settings |
| TerraLab team owner | Pastes the issuer URL, turns team sign-in on, invites members by email | [Dashboard, MCP](https://terra-lab.ai/dashboard/mcp), **Team sign-in** |
| Each member | Accepts the invitation once, signed in with the invited email | [Dashboard, MCP](https://terra-lab.ai/dashboard/mcp), **Team invitations** |

The admin and the owner can be the same person.

## 1. Add TerraLab to your Claude organization

In Claude, open **Admin settings**, **Connectors**, and add TerraLab with the server URL:

```text
https://mcp.terra-lab.ai/mcp
```

Open the connector. In its **Authentication** section, click **Set up** on the **Managed authorization** row and choose **Claude-issued** under **Identity source**. Claude shows an **Issuer URL** of the form `https://identity.anthropic.com/issuers/<issuer-id>`. Copy it exactly.

## 2. Create your TerraLab team

1. Sign in at [terra-lab.ai/login](https://terra-lab.ai/login) with the account that owns the team.
2. Open [Dashboard, MCP](https://terra-lab.ai/dashboard/mcp) and unfold **Team sign-in for Claude Team and Enterprise**.
3. Paste the issuer URL in **Trusted issuer URL**, tick **Turn on team sign-in** and click **Save**.
4. Copy the **Tenant ID** shown under the form and paste it in the **Tenant ID** field of Claude's managed authorization setup. It is optional but recommended: it ties Claude's assertions to your team. Without it, TerraLab picks the team the member accepted; it is required only when one email has accepted several teams that trust the same issuer.

## 3. Invite your members

Add each member's email under **Members**: the address of their Claude account. Each member then signs in to terra-lab.ai with that email, opens [Dashboard, MCP](https://terra-lab.ai/dashboard/mcp) and clicks **Accept** under **Team invitations**. A member without a TerraLab account creates one by signing in.

From then on, the member's Claude connects to TerraLab on its own and renews access every hour without asking.

The acceptance step is deliberate: an issuer URL is not a secret, so TerraLab never lets a team act for an account that did not agree to join it. The invitation shows the issuer URL, and the acceptance holds for that issuer only.

## 4. Test the connection

In Claude's managed authorization setup, click **Run test** under **Connection status**. A member who has not accepted yet gets `invalid_grant` with the reason in the description.

## Usage and billing

Each member's calls count against that member's own TerraLab account: 100 free calls a month, then their balance. See [Pricing](https://terra-lab.ai/docs/pricing).

## Remove access

| To | Do |
| --- | --- |
| Remove one member | **Remove** next to the email. Their access stops at the next call. |
| Stop the whole team | Untick **Turn on team sign-in** and save. Every member's access stops at the next call. |
| Leave a team | **Leave** under **Team invitations**. |

Changing the issuer URL also ends every access issued under the old one, and every member must accept again. When someone leaves your Claude organization, Claude stops vouching for them at once; remove them here too.

## For identity providers

An identity provider that issues ID-JAG assertions (for example Okta Cross App Access) works the same way: paste its issuer URL instead of Claude's. TerraLab finds the member by the `email` claim, so the provider must send it.

| What | Value |
| --- | --- |
| Token endpoint | `https://terra-lab.ai/oauth/token` |
| Grant | `urn:ietf:params:oauth:grant-type:jwt-bearer` |
| Assertion `typ` | `oauth-id-jag+jwt`, signed ES256 or RS256 |
| Assertion `aud` | `https://terra-lab.ai` |
| Optional `aud_tenant` | Your team's Tenant ID |
| Access token | 1 hour, no refresh token |

Source: https://terra-lab.ai/docs/team-sign-in · Updated 2026-11-04