Set up enterprise-managed authentication

1. 1

   Make sure your Lovable workspace is on a Business or Enterprise plan, you have admin access to Lovable, Okta, and Claude, and Okta is already set up as an SSO provider in Lovable with 'Third-party MCP client access' enabled.

   These are essential prerequisites for enterprise-managed authentication to function.

2. 2

   In Lovable, go to 'Workspace settings' > 'Access' > 'Identity', then in 'Enterprise-managed authentication', click 'Set up'.

   This is where you begin the configuration process within Lovable.

3. 3

   Choose your existing Okta SSO provider and click 'Continue'.

   You must link this feature to your team's current Okta setup.

4. 4

   Confirm the provider details and, if using SAML, enter the 'Assertion issuer' from Okta. Copy the 'Audience' and 'MCP resource' values.

   These values are crucial for Lovable to verify identities from Okta and will be used in your Okta and Claude configurations.

5. 5

   Review the settings and click 'Enable team access'.

   This saves the Lovable-side configuration, but the setup is not complete until Okta and Claude are also configured.

6. 6

   In Okta, enable 'Cross App Access' (XAA) for your existing Lovable SSO app and connect Claude's agent to it, using the 'Audience' and 'MCP resource' values you copied from Lovable.

   This allows Claude to request proof of identity from Okta to access Lovable on behalf of your team members.

7. 7

   In Claude, go to the Lovable connector's 'Configuration' tab, set up 'Managed authorization', choose who gets access, select permissions (like 'workspaces:read' and 'projects:read'), and use 'Run test'.

   This configures Claude to use the enterprise-managed authentication and verifies the connection.

8. 8

   As a test member (who doesn't have a personal Lovable connection in Claude), sign into Claude through Okta and ask Claude to use Lovable, for example, 'Use Lovable to list the projects in our [workspace name] workspace'.

   This confirms that the entire setup works correctly and Claude can access Lovable without requiring individual sign-ins.

Hey team, I'm setting up enterprise-managed authentication for Lovable with Claude and Okta. I've enabled it in Lovable and copied the 'Audience' (https://lovable.dev/oauth) and 'MCP resource' (https://mcp.lovable.dev) values. Could you please enable Cross App Access (XAA) for our existing Lovable SSO app in Okta, connect Claude's agent to it using these values, and ensure the necessary permissions like 'workspaces:read' and 'projects:read' are granted? Also, in Claude, please set up 'Managed authorization' for the Lovable connector and assign access to our pilot group. Let me know once that's done so I can test it.

Single Sign-On (SSO)

A system that lets you log in once to one service (like Okta) and then automatically access many other services (like Lovable) without needing to log in again for each one.

Okta

A company that provides identity management services, often used by businesses to manage who can access their various software applications.

Cross App Access (XAA)

An Okta feature that allows one application (like Claude) to securely request identity information from Okta to access another application (like Lovable) on a user's behalf.

Identity assertion

A digitally signed message that proves a user's identity and is used to grant access to a service. It's like a secure digital ID card.

Assertion issuer

The unique identifier of the system (like Okta) that creates and issues the identity assertion, confirming who the user is.

Audience

The intended recipient of an identity assertion; in this case, it tells Okta that the identity information is meant for Lovable.

MCP resource

A specific identifier for Lovable's backend service that Claude will be trying to access.

• Trying to set this up without a Lovable Business or Enterprise plan, or without the necessary admin permissions in Lovable, Okta, and Claude.
• Not enabling 'Third-party MCP client access' in your Lovable workspace, which is required for Claude to connect.
• Assuming that existing Okta SSO means XAA is automatically supported; XAA must be explicitly enabled and configured.
• Deleting or replacing a working SSO app in Okta to expose XAA controls, which can disrupt existing sign-ins.
• Using a test member who already has a personal Lovable connection in Claude, as this won't properly verify the enterprise-managed setup.
• Expecting enterprise-managed authentication to create Lovable accounts or link existing ones; members must already have Lovable accounts linked to SSO.
• Not configuring all three systems (Lovable, Okta, and Claude) completely, as saving settings in one does not complete the entire setup.
• Ignoring the warning about SSO session duration, as Claude can remain connected beyond Lovable's session duration while Okta authorizes access.
• Trying to create a new configuration if an 'assertion issuer and IdP tenant already have an active connection' error appears; you must manage the existing shared configuration instead.