Skip to main content
Enterprise-managed connections let admins connect Claude to the Mixpanel MCP Server for every member at once. Members don’t sign in or approve anything. A Claude admin and a Mixpanel organization admin set it up once, and an Okta admin joins if you use Okta as the issuer. Mixpanel still checks each person’s project and data access on every request. Without managed authorization, the Mixpanel MCP Server asks each member to authorize the connection between Claude and Mixpanel. With managed authorization, there is no approval step. When a member uses Mixpanel in Claude, the issuer (Claude or Okta) vouches for the member’s identity and sends Mixpanel their email address. Mixpanel matches that email to a user in your organization and authorizes Claude to act as that user. Each connection lasts up to one hour. After that, Claude gets a new authorization from the issuer. If the member has lost access by then, the new connection fails. If a member belongs to more than one Mixpanel organization, the connection works the same way a normal Mixpanel sign-in does: the member can reach any project they already have access to, including projects in other organizations.

​
Before you begin

  • Admin access for each role in your chosen path. One person can hold more than one role. See Choose your setup.
  • A Claude plan that supports managed authorization for connectors. See Claude’s guide and the Mixpanel pricing page.
  • MCP enabled for your Mixpanel organization. See Permissions and access.
  • A claimed email domain on your Mixpanel organization, for the domain your members use in Claude. Mixpanel only accepts members whose email domain is verified on the organization.
  • Matching emails. Each member’s Claude email must match their verified Mixpanel email. Mixpanel compares the full address and ignores only letter case, so aliases and plus-addresses don’t match.
Claude doesn’t require SSO for this setup, although Anthropic recommends enforcing it.

​
Choose your setup

Both paths end the same way: you test and enable the connection in Claude. They differ in who vouches for each member. With Claude as the issuer, Claude confirms only that the person is a current member of your Claude organization with that email address. It doesn’t confirm a sign-in at your IdP, and it doesn’t check your MFA or Mixpanel’s own sign-in rules, including Mixpanel SSO. Mixpanel receives the member’s email address and an opaque identifier. If you need those rules applied, use Okta. With Okta as the issuer, Mixpanel receives the member’s email address.

​
Set up with Claude as the issuer

With this setup, members are connected to Mixpanel in Claude automatically, with no sign-in screen and no Okta configuration. Members act as themselves in Mixpanel, with the permissions they already have there.

​
Settings

​
Connect Claude and Mixpanel

  1. Copy the issuer URL (Claude admin) In Claude, open organization settings, select the Mixpanel connector, and select Managed authorization on the Configuration tab. In the Connect step, select Claude-issued. Copy the issuer URL shown. If you aren’t a Mixpanel organization admin, send the issuer URL to one.
  2. Add the issuer in Mixpanel (Mixpanel organization admin) Go to Organization Settings → Access Security → Claude Access and click Add Identity Provider. Paste the issuer URL into Issuer URL, leave JWKS URL blank, and click Add. The issuer appears in the list with the status Active. If Add Identity Provider is disabled, your organization hasn’t verified an email domain. Verify one on the Domain Claiming tab, then try again. See Claim a domain.
Continue to Test and enable in Claude.

​
Set up with Okta as the issuer

​
Settings

You will have to create a separate Mixpanel app in Okta for this integration. We have two different set up options: OIDC and SAML 2.0. If you’ve already set up an app in Okta for Mixpanel MCP, you can skip the app creation steps and use the existing app. Okta app integration, OIDC: Okta app integration, SAML 2.0: Mixpanel, Claude Access tab:
Warning: For Issuer URL, don’t use the admin console address (acme-admin.okta.com) or an authorization server URL (.../oauth2/default).

​
Connect Okta, Claude, and Mixpanel

  1. Create the Mixpanel MCP app (Okta admin) Mixpanel isn’t in Okta’s app catalog with Cross App Access (XAA), Okta’s feature that lets one app reach another app on a user’s behalf without a separate sign-in or consent screen. Instead, create a custom app integration using either OIDC or SAML 2.0. See Okta’s guide to creating an app integration. Use the values in the Okta tables above. Or view the instructions for SAML 2.0 to set up the Mixpanel app in Okta. On the Assignments tab, assign the users who should have access. For SAML 2.0, the app isn’t used to sign in, which is why the settings hide its icon.
  2. Connect the app to Claude (Claude admin) In Claude, open organization settings, select the Mixpanel connector, and select Managed authorization on the Configuration tab. In the Connect step, select IdP-managed. Scroll down to the setup guide and click Open WorkOS setup, or Send to an admin if you aren’t an admin of your IdP. Follow the instructions to connect the Mixpanel MCP app from the previous step to Claude.
  3. Add the issuer in Mixpanel (Mixpanel organization admin) Go to Organization Settings → Access Security → Claude Access and click Add Identity Provider. Enter your Okta org URL in Issuer URL, leave JWKS URL blank, and click Add. The issuer appears in the list with the status Active. If Add Identity Provider is disabled, your organization hasn’t verified an email domain. Verify one on the Domain Claiming tab, then try again. See Claim a domain.
Continue to Test and enable in Claude.

​
Test and enable in Claude

Both paths finish here. A Claude admin does these steps.
  1. Run the test In the Claude connector setup, click Run Test and confirm that every check passes. The test stops at the first check that fails. See Troubleshooting.
  2. Enable the connection Click Enable and continue, then complete the Roles and Scopes steps. Every role gets managed authorization by default. To narrow scopes and permissions, see Claude’s guide.

​
Verify the connection

Before you announce the change, ask two or three members to open Claude and run a request that uses Mixpanel. You should see Mixpanel already connected in Claude, with no sign-in or consent screen. To confirm on the Mixpanel side, check the audit log for an mcp_client.authorized entry. Each connection is recorded in the audit log of every Mixpanel organization the member belongs to. Because connections last up to an hour, you’ll see a new entry roughly every hour while a member is actively using Mixpanel in Claude. If a member sees the normal Connect prompt instead, Mixpanel found no matching account for them. Check that their Claude email matches their Mixpanel email, that the domain is verified on your Mixpanel organization, and that they are a member of the organization.

​
Troubleshooting

Run Test stops at the first check that fails. The checks refer to an ID-JAG (Identity Assertion JWT Authorization Grant): a short-lived, signed statement from the issuer that says who the member is. Mixpanel exchanges it for an access token that lets Claude act as that member. If Claude says Mixpanel’s authorization server address changed, run the test again, check the new address, and confirm it.

​
Remove access or turn off the connection

​
Remove a member’s access

To stop access right away, remove the member from your Mixpanel organization. A connection that’s already active can keep working for up to an hour, so removing them only from the issuer isn’t enough. To stop new connections, also remove them from the issuer:
  • Claude as the issuer: remove them from your Claude organization.
  • Okta as the issuer: remove them from Okta, or unassign them from the Mixpanel MCP app.
To fully revoke access, confirm the member is removed from the issuer. If you sync users from a directory, check your issuer’s documentation for how suspended or inactive users are handled.
Warning: If you give a former member’s email address to someone new, remove the former member’s Mixpanel account first. Otherwise the new person connects to the old account.

​
Pause or turn off the connection

In Claude, open the connector’s Managed authorization settings and choose Disable. Members then connect to Mixpanel themselves. To stop trusting the issuer entirely, also turn it off on Mixpanel’s Claude Access tab. New connections stop, and active ones expire within an hour. Turn it back on to resume.

​
FAQ

​
Do members need to do anything?

No. After an admin finishes setup, Mixpanel shows up as already connected in Claude, with no sign-in or approval screen. A member with no matching Mixpanel account sees the normal Connect prompt and can sign in the usual way.

​
What can Claude access in Mixpanel on a member’s behalf?

Only what that member can already access. Claude acts as the member, and Mixpanel checks their project and data permissions on every request. Managed authorization doesn’t grant any extra access.

​
Which Claude and Mixpanel plans support this?

Claude Team or Enterprise, and any Mixpanel plan.

​
What happens if a member belongs to more than one Mixpanel organization?

The connection works the same way a normal Mixpanel sign-in does: the member can reach any project they already have access to, including projects in other organizations.

​
Does this replace Mixpanel SSO?

No. Mixpanel SSO still controls sign-in to Mixpanel itself. With Claude as the issuer, Mixpanel’s sign-in rules, including SSO, aren’t applied to the Claude connection. If you need those rules, use Okta as the issuer. See Choose your setup.

​
Does Mixpanel support XAA?

Yes, through the custom Okta app described above. Mixpanel isn’t currently available in Okta’s app catalog with XAA support.

​
Next steps