Amazon Bedrock AgentCore Identity vs Arcade.dev

Amazon Bedrock AgentCore Identity

The service handles user-delegated, machine-to-machine and on-behalf-of token flows through one call, with IAM scoping, KMS encryption and published quotas. It only works inside an AWS account a person creates, the hosted consent portal needs an AgentCore Gateway, and no call to revoke one user's stored grant was found in the API reference.

Arcade.dev

Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise.

Amazon Bedrock AgentCore Identity

1. Get a workload access token first (GetWorkloadAccessTokenForJWT in production), then pass it as workloadIdentityToken to GetResourceOauth2Token or GetResourceApiKey.
2. When GetResourceOauth2Token returns authorizationUrl instead of accessToken, send the URL to the user and call again with the same sessionUri after consent.
3. For user-delegated flows, host an HTTPS callback, register it with UpdateWorkloadIdentity as an allowed return URL, and call CompleteResourceTokenAuth after checking the user's session.
4. Ask for refresh tokens in the provider's own way, such as access_type=offline in customParameters for Google or the offline_access scope for Microsoft and Atlassian.
5. Treat a returned token as possibly revoked. On a 401 from the resource server, retry with forceAuthentication set to true.

Arcade.dev

1. Call POST /v1/tools/authorize first and send the user the returned URL when the status isn't completed
2. Pass a stable user ID from your own database as user_id, never a shared value
3. Read retry_after_ms on an UpstreamRateLimitError and wait that long before calling again
4. Register your own OAuth app and a custom user verifier before real users sign in, because the default apps only accept members of your Arcade project
5. Revoke a user's access with DELETE /v1/admin/user_connections/{id}