Enterprise-managed auth

Enterprise-managed authorization (EMA) centralizes Claude's connection to Amplitude. An organization admin configures access once, and members connect without approving an Amplitude consent screen. Claude acts as the signed-in member, and Amplitude enforces that member's organization membership, project access, and role permissions.

Use EMA for centrally managed connections. Use standard OAuth when each person should approve their connection, or an MCP service account for unattended workflows.

Choose an identity provider

EMA supports two setup paths, both connecting Claude as an existing Amplitude member. Other identity providers must support EMA-compatible identity assertions; OpenID Connect support alone doesn't establish compatibility.

Setup path	Issuer URL to enter in Amplitude
Claude-issued identity	The organization-specific issuer Claude displays during managed-authorization setup, such as `https://identity.anthropic.com/issuers/<issuer-id>`.
Okta Cross App Access	Your Okta organization's issuer, such as `https://acme.okta.com`. Configure the Claude-to-Amplitude resource connection in Okta.

Prerequisites

You can manage connectors in your Claude organization.
You are an organization admin in the Amplitude organization you're configuring. Amplitude single sign-on does not need to be configured or enabled.
Cross App Access is visible under Settings > Content Access > MCP. Only organization admins can see it or add and remove providers.
Each member already belongs to the target Amplitude organization, has activated their account, and has accepted their invitation.
The identity assertion's email claim matches the existing member's Amplitude login email.

EMA uses identity assertions, not Amplitude's SAML or SSO login. For Okta, you also need an administrator who can configure Cross App Access and the Claude AI agent's connection to Amplitude.

EMA doesn't create Amplitude accounts or add members to an organization. Members don't need the organization admin role to use an EMA connection. Their existing Amplitude permissions determine their access.

Set up Claude-issued identity

In Claude's organization connector settings, add or select the Amplitude connector and open its managed-authorization setup.
Select Claude-issued identity and copy the exact issuer URL Claude displays.
In Amplitude, go to Settings > Content Access > MCP.
Under Cross App Access, select Add identity provider.
Paste the issuer into Issuer URL.
Leave Signing keys URL (JWKS) blank to let Amplitude discover it. If discovery fails, enter the signing keys URL from the issuer's discovery information.
Select Add.
Return to Claude and run the connection test. If Claude exposes scope controls, select only the scopes the connection should request.

Copy the complete issuer URL. Don't use a generic Claude URL or construct an issuer URL from an older tenant ID. The example above shows the format, not a value to paste.

Set up Okta Cross App Access

In Okta, configure and activate Claude's AI agent against the application your members use to sign in to Claude.
Configure the Amplitude resource connection for Cross App Access, following Claude's setup instructions. Allow the scopes your organization intends to grant.
In Amplitude, go to Settings > Content Access > MCP.
Under Cross App Access, select Add identity provider.
Enter your exact Okta organization issuer, such as https://acme.okta.com. Use the organization authorization server, not a URL ending in /oauth2/default.
Leave Signing keys URL (JWKS) blank for discovery, or enter the provider's signing keys URL.
Select Add.
Return to Claude, finish the Okta managed-authorization setup, and run the connection test. If Claude exposes scope controls, select only the scopes the connection should request.

Claude's AI agent is the client. The identity assertion's subject must be an existing Amplitude member. Amplitude rejects Okta assertions with sub_profile: ai_agent. The assertion must include an email claim that matches the member's Amplitude login. The account must be activated and the invitation accepted. EMA doesn't create accounts.

Read-only and read/write access

Adding an identity provider in Amplitude always allows both all:read and all:write. There's no read-only or read/write setting for a provider in Amplitude. Narrow access through Claude's requested scopes and your identity provider's scope policy.

EMA supports these Amplitude scopes:

Intended access	Scopes
Read only	`all:read`
Read and write	`all:read` and `all:write`

The legacy names mcp:read and mcp:write are also accepted.

These scopes apply to EMA connections acting as an existing Amplitude member. EMA write access remains limited by the member's Amplitude role.

If the token request names no Amplitude scope, the server defaults to both read and write, still capped by the identity assertion. Omitting scopes doesn't make the connection read-only.

For a read-only connection, configure the identity provider's scope policy so the assertion permits only all:read. If Claude sends Amplitude scopes, request only all:read there too.

Scopes can narrow access but can't give a member more access than their Amplitude role permits. EMA drops admin and product-specific scopes.

Verify the connection

After Claude's connection test passes, ask:

Use the Amplitude connector to show my connected organization and the projects I can access. Don't make any changes.

Confirm that Claude identifies the expected organization and projects. For a read-only connection, confirm that write operations remain unavailable.

Choose the server for your data region. Use https://mcp.amplitude.com/mcp for United States data and https://mcp.eu.amplitude.com/mcp for European Union data. The Amplitude connector in Claude's directory points to the US endpoint; an EU connection must target the EU endpoint.

Troubleshooting

Problem	What to check
Cross App Access isn't visible	Confirm that you are an organization admin and that you're viewing the intended organization. Amplitude single sign-on does not need to be configured or enabled.
Amplitude can't discover signing keys	Check the exact issuer URL. If necessary, enter the JWKS URL from the provider's discovery information.
The identity assertion is rejected	Check the issuer and confirm that the assertion identifies a person, not an AI agent. Its `email` claim must match an existing member's Amplitude login. The member must have an activated account and an accepted invitation.
The connection reports `invalid_scope`	Compare the scopes Claude sends with those permitted by the identity provider. If Claude sends Amplitude scopes, remove the write scope for read-only access. Also ensure the identity provider's scope policy limits the assertion to read-only. A token request with no Amplitude scope defaults to read and write, capped by the assertion.
Authentication succeeds, but a tool is unavailable	Check the granted scopes and the member's Amplitude role and project access.
The exchange reports a temporary signing-key failure	Retry after provider connectivity recovers. Changing permissions won't resolve a signing-key availability problem.

Remove an identity provider

In Settings > Content Access > MCP, select the provider under Cross App Access.
Select Remove provider, then confirm with Remove.

Amplitude blocks new connections through that provider. Existing connections stop working within a minute.

Was this helpful?