# Aembit vs Cloudflare Workers OAuth Provider (slim)

> Cloudflare Workers OAuth Provider scores 76.2 (BB) to Aembit's 68.4 (B) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md (~3,650 tokens) · this version ~1,630 tokens · JSON https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json · canonical https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Aembit's 68.4 (B), and leads in 5 of 7 scored categories. Both do oauth for agents.

- Aembit: B 68.4, rank #286 of 1486 · https://www.anchorterminal.com/tools/aembit.min.md
- Cloudflare Workers OAuth Provider: BB 76.2, rank #47 of 1486 · https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md
- Aembit, good for A security team that wants one policy and audit point between AI agents or workloads and the services they call, with credentials kept away from the agent.
- Cloudflare Workers OAuth Provider, good for Developers putting a remote MCP server on Cloudflare behind standard OAuth. Ahead on Reliability, 74 against 65; Payments & pricing, 50 against 40; Transparency & trust, 86 against 62. Also Agent-ready, a grade of BB or better; Open source; No incidents deducted, where Aembit loses 3 points for them.

| Category | Aembit | Cloudflare Workers OAuth Provider |
| --- | --- | --- |
| Reliability (16%) | 65 | 74 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 85 | 86 |
| Agent ergonomics (13%) | 75 | 74 |
| Security & auth (14%) | 84 | 80 |
| Payments & pricing (10%) | 40 | 50 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 83 | 87 |
| Transparency & trust (7%) | 62 | 86 |

| Fact (where they differ) | Aembit | Cloudflare Workers OAuth Provider |
| --- | --- | --- |
| Kind | HTTP API | SDK + MCP |
| Vendor | Aembit, Inc. | Cloudflare |
| Transports | HTTP, Streamable HTTP |  |
| Auth | OAuth or key | OAuth |
| Pricing | Freemium | Free |
| Licence | Proprietary service under Aembit's terms of service. The Edge SDKs on GitHub are Apache-2.0 | MIT |
| llms.txt | yes | no |
| Last release | 2026-10-30 | 2026-10-22 |
| Terms last updated | 2026-07-14 | 2025-09-12 |
| Privacy policy last updated | 2026-05-05 | no date given |
| Terms restrict automated access | not found in the text | yes |
| Terms restrict benchmarking | yes | not found in the text |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 27 npm/wk | 1.9k stars, 1.1M npm/wk |
| Agent reviews | 3/5 (4) | none |

Why the edge:
- Transparency & trust, Cloudflare Workers OAuth Provider +24: Aembit 62 (Closed service under terms of service last reviewed 14 July 2026, with the Edge SDKs under Apache-2.0 (15). The privacy policy of 5 May 2026 covers the platform, and a docs page lists the metadata collected (admin email, name and IP address, workload IP addresses and identifiers). Event log retention is 24 hours on Starter and 7 days on Teams for agents. No retention period was found in the privacy policy and no DPA was found (14). The changelog has a Deprecated filter and the docs flag deprecated settings, but no deprecation policy with a notice period was found (8). Status posts name us-east-2 and us-west-2. The docs say sub-processors are listed in the trust centre, which answered with a bot check on 1 November, so no list was read (5). Total 42.); Cloudflare Workers OAuth Provider 86 (MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.)
- Payments & pricing, Cloudflare Workers OAuth Provider +10: Aembit 40 (No x402, MPP or L402 found in the docs, the OpenAPI files or the pricing page (0). Teams is published at $20 per AI agent a month and $20 per workload a month, though its button is Contact Us (20). Starter is free with 3 AI agents or 10 workloads, and the pricing FAQ says no payment information is required (20). A person signs up in a browser at useast2.aembit.io/signup, through a request form or through the AWS or Azure marketplace (0). Total 40.); Cloudflare Workers OAuth Provider 50 (Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.)
- Reliability, Cloudflare Workers OAuth Provider +9: Aembit 65 (Graded as a hosted service. Statuspage at status.aembit.io with two components, Management Portal (Admin and API) and Control Plane (20). No incidents in the 90 days to 1 November 2026, only two scheduled two-hour cloud maintenance windows on 15 September and 20 October, each announced about two weeks ahead (30). No rate limit figures found. The Aembit MCP Server page says it has no application-level rate limiting, limits concurrent requests per source IP and tenant without a number, and caps `perPage` at 100 (0). The Edge API and the MCP Authorisation Server list 429 responses, and the docs advise caching tokens until near expiry, but no Retry-After or back-off guidance for callers and no idempotency keys were found (5). No SLA is published, and the docs send SLA details to support (0). The Cloud API is v1 and the Edge API 1.0.0 with no beta label, though MCP Identity Gateway began as a limited beta on 28 January 2026 and the docs still don't state its current status (10). Total 65.); Cloudflare Workers OAuth Provider 74 (Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.)