Aembit vs Cloudflare Workers OAuth Provider

Aembit 62

Closed service under terms of service last reviewed 14 July 2026, with the Edge SDKs under Apache-2.0 (15). The privacy policy of 5 May 2026 covers the platform, and a docs page lists the metadata collected (admin email, name and IP address, workload IP addresses and identifiers). Event log retention is 24 hours on Starter and 7 days on Teams for agents. No retention period was found in the privacy policy and no DPA was found (14). The changelog has a Deprecated filter and the docs flag deprecated settings, but no deprecation policy with a notice period was found (8). Status posts name us-east-2 and us-west-2. The docs say sub-processors are listed in the trust centre, which answered with a bot check on 1 November, so no list was read (5). Total 42.

Cloudflare Workers OAuth Provider 86

MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating resolveExternalToken, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.

Aembit 40

No x402, MPP or L402 found in the docs, the OpenAPI files or the pricing page (0). Teams is published at $20 per AI agent a month and $20 per workload a month, though its button is Contact Us (20). Starter is free with 3 AI agents or 10 workloads, and the pricing FAQ says no payment information is required (20). A person signs up in a browser at useast2.aembit.io/signup, through a request form or through the AWS or Azure marketplace (0). Total 40.

Cloudflare Workers OAuth Provider 50

Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.

Aembit 65

Graded as a hosted service. Statuspage at status.aembit.io with two components, Management Portal (Admin and API) and Control Plane (20). No incidents in the 90 days to 1 November 2026, only two scheduled two-hour cloud maintenance windows on 15 September and 20 October, each announced about two weeks ahead (30). No rate limit figures found. The Aembit MCP Server page says it has no application-level rate limiting, limits concurrent requests per source IP and tenant without a number, and caps perPage at 100 (0). The Edge API and the MCP Authorisation Server list 429 responses, and the docs advise caching tokens until near expiry, but no Retry-After or back-off guidance for callers and no idempotency keys were found (5). No SLA is published, and the docs send SLA details to support (0). The Cloud API is v1 and the Edge API 1.0.0 with no beta label, though MCP Identity Gateway began as a limited beta on 28 January 2026 and the docs still don't state its current status (10). Total 65.

Cloudflare Workers OAuth Provider 74

Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.