Aembit vs Arcade.dev

Aembit

Agents and workloads get short-lived credentials by attestation, and MCP clients sign in through OAuth 2.1 with policy checked on every request. Both APIs have public OpenAPI files. No rate limit figures or SLA are published, the managed gateway endpoint is requested through an Aembit representative, and no DPA or sub-processor list was found.

Arcade.dev

Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise.

Aembit

1. Read the API Base URL and token from the tenant's Profile page. Tokens last 1 hour by default, so plan to refresh
2. Send X-Aembit-ResourceSet on Cloud API, Edge API and MCP calls outside the default Resource Set, or the request runs against the default set
3. Cache the Edge API access token from /edge/v1/auth until near expiry before calling /edge/v1/credentials. Both endpoints can answer 429
4. Point MCP clients at https://<gateway-host>/mcp. The /me path is deprecated
5. Expect tool names prefixed with the Server Workload name behind the MCP Identity Gateway, and keep perPage at 100 or less on the Aembit MCP Server

Arcade.dev

1. Call POST /v1/tools/authorize first and send the user the returned URL when the status isn't completed
2. Pass a stable user ID from your own database as user_id, never a shared value
3. Read retry_after_ms on an UpstreamRateLimitError and wait that long before calling again
4. Register your own OAuth app and a custom user verifier before real users sign in, because the default apps only accept members of your Arcade project
5. Revoke a user's access with DELETE /v1/admin/user_connections/{id}