Auth for MCP: Resolve Organization from resource or an application-level default

Product Feedback
1

Feature: Organization routing for Auth for MCP via resource or an application-level default

Description: Allow Auth0 to determine the Organization when a third-party MCP client does not include organization in its /authorize request. The customer would accept either of these options:

  • Resolve the Organization from resource: Support an administrator-configured mapping between the OAuth resource value and an Auth0 Organization.

  • Default Organization per application: Allow a third-party application to have a default Organization for interactive authorization-code flows.

Organization resolution must happen before authentication and enterprise connection selection, so users can reach their company’s Okta or Microsoft Entra ID login without entering an Organization name or relying on email-domain matching.

Use-case: The customer operates a multi-tenant MCP server. Their enterprise customers sign in through their own Okta or Entra ID connections configured within Auth0 Organizations.

They want to use Auth for MCP, but report that MCP clients including Claude, Cursor, ChatGPT, and Snowflake build their own /authorize requests without sending organization. Asking users for an Organization name or matching their email domain does not meet their requirements.

Today, they maintain a custom authorization server. The MCP URL includes the Organization ID in its path, and the client sends that URL as resource. Their server extracts the Organization ID and passes it to Auth0 as organization. The customer reports that Snowflake removes the URL path, so they use a separate OAuth client for each enterprise customer instead.

Native support would let them replace this custom authorization-server workaround with Auth for MCP while preserving direct routing to each customer’s enterprise login. A per-application default Organization would also accommodate their Snowflake setup.