Web access uses Supabase Auth. MCP clients should use a user-generated API key from the dashboard after sign-in.
New accounts need email confirmation before they can sign in. Keep email confirmations enabled in Supabase Auth.