{ "data": { "a": { "slug": "agentcore-identity", "name": "Amazon Bedrock AgentCore Identity", "vendor": "Amazon Web Services", "vendorUrl": "https://aws.amazon.com/bedrock/agentcore/", "kind": "http-api", "category": "agent-auth", "summary": "Amazon Bedrock AgentCore Identity is an AWS service that gives agents workload identities, stores OAuth tokens and API keys in a token vault, and runs OAuth flows so agents can call third-party services for users or for themselves.", "url": "https://www.anchorterminal.com/tools/agentcore-identity", "markdownUrl": "https://www.anchorterminal.com/tools/agentcore-identity.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/agentcore-identity.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/agentcore-identity.json", "repo": "https://github.com/aws/bedrock-agentcore-sdk-python", "license": "Proprietary service under the AWS Customer Agreement and AWS Service Terms. The AgentCore SDKs for Python and TypeScript are Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://bedrock-agentcore.us-east-1.amazonaws.com", "packages": [ { "registry": "pypi", "name": "bedrock-agentcore" }, { "registry": "npm", "name": "bedrock-agentcore" }, { "registry": "npm", "name": "@aws-sdk/client-bedrock-agentcore" }, { "registry": "pypi", "name": "boto3" } ], "auth": "mixed", "authNotes": "A person creates an AWS account and an IAM role. Control-plane calls (`bedrock-agentcore-control`) and data-plane calls (`bedrock-agentcore`) are SigV4-signed with IAM credentials, and the data plane also documents an OAuth bearer route (`UnauthorizedException` for an invalid JWT). The agent first gets a workload access token that carries its own identity and the user's, from a JWT (`GetWorkloadAccessTokenForJWT`), a user ID string (`GetWorkloadAccessTokenForUserId`) or neither (`GetWorkloadAccessToken`), then exchanges it for a third-party OAuth token or API key. Each third-party provider needs an OAuth client the owner registers with that provider. AgentCore Runtime and Gateway fetch the workload access token for the agent.", "pricing": "usage", "pricingNotes": "$0.010 per 1,000 OAuth token or API key requests for non-AWS resources, billed per successful request, with no minimum fee. No additional charge when the service is used through AgentCore Runtime or AgentCore Gateway, which are billed on their own meters. No free tier specific to Identity was found. New AWS accounts get up to $200 of Free Tier credit for up to 6 months, and AWS says most new customers need no payment method at sign-up though it may ask for one (https://aws.amazon.com/bedrock/agentcore/pricing/, https://aws.amazon.com/free/free-tier-faqs/).", "priceSummary": "$0.01 / 1k req", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 for paying AWS on the pricing page or in the docs. AgentCore payments is a separate capability for agents paying third-party sellers (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 334717, "pypiWeekly": 1421946, "asOf": "2026-10-08" }, "docsUrl": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity.html", "llmsTxt": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/llms.txt", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "auth.audit", "infra.aws" ], "tags": [ "hosted", "closed-source", "usage-priced", "oauth", "llms-txt", "python", "typescript", "enterprise", "sla", "soc2", "eu" ], "lastRelease": "2026-09-01", "graded": true, "anchor": { "graded": true, "score": 74.8, "grade": "BB", "agentReady": true, "rank": 64, "ranked": true, "rankOf": 842, "categoryRank": 2, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 76, "maintenance": 70, "payments": 30, "reliability": 85, "schema": 88, "security": 84, "transparency": 75 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-08" }, "negative": 0, "verdict": "The service handles user-delegated, machine-to-machine and on-behalf-of token flows through one call, with IAM scoping, KMS encryption and published quotas. It only works inside an AWS account a person creates, the hosted consent portal needs an AgentCore Gateway, and no call to revoke one user's stored grant was found in the API reference.", "bestFor": "Agents already built on AWS, above all those on AgentCore Runtime or Gateway, where token retrieval is automatic and free of extra charge.", "strengths": [ "`GetResourceOauth2Token` covers three flows (USER_FEDERATION, M2M and ON_BEHALF_OF_TOKEN_EXCHANGE) and returns either an access token or an authorisation URL with a session URI.", "25 OAuth vendor values in `CreateOauth2CredentialProvider`, 24 built in (Google, GitHub, Slack, Salesforce, Microsoft, Atlassian and others) plus a custom OAuth 2.0 provider.", "Quotas are published per operation, 200 requests a second for the three workload access token calls and 20 for each management call, all adjustable.", "The token vault is encrypted with an AWS owned KMS key by default or a customer managed key, and IAM policies can name one workload identity and one credential provider.", "$0.010 per 1,000 token or API key requests, with no extra charge when used through AgentCore Runtime or Gateway." ], "weaknesses": [ "No operation to revoke or delete one user's stored grant was found. `forceAuthentication` clears a refresh token, and AWS says it cannot detect a revocation made at the provider.", "The consent portal, launched 1 September 2026, attaches to one AgentCore Gateway with JWT inbound auth and cannot use GitHub, Slack, Salesforce, Atlassian or LinkedIn as its sign-in provider.", "`GetWorkloadAccessTokenForUserId` takes a user ID string the platform does not verify, so the binding to a user rests on the caller and its IAM policy.", "AWS states the service enforces no binding between workload identities and credential providers in one account beyond the IAM policy the owner writes.", "No CloudTrail page for AgentCore Identity was found in the developer guide, though Gateway and Agent Registry each have one." ], "agentNotes": [ "Get a workload access token first (`GetWorkloadAccessTokenForJWT` in production), then pass it as `workloadIdentityToken` to `GetResourceOauth2Token` or `GetResourceApiKey`.", "When `GetResourceOauth2Token` returns `authorizationUrl` instead of `accessToken`, send the URL to the user and call again with the same `sessionUri` after consent.", "For user-delegated flows, host an HTTPS callback, register it with `UpdateWorkloadIdentity` as an allowed return URL, and call `CompleteResourceTokenAuth` after checking the user's session.", "Ask for refresh tokens in the provider's own way, such as `access_type=offline` in `customParameters` for Google or the `offline_access` scope for Microsoft and Atlassian.", "Treat a returned token as possibly revoked. On a 401 from the resource server, retry with `forceAuthentication` set to true." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.8 } ], "editorialScores": { "ergonomics": 76, "maintenance": 70, "payments": 30, "reliability": 85, "schema": 88, "security": 84, "transparency": 61 }, "provenanceScore": 88 }, "connect": { "install": "pip install bedrock-agentcore" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/agentcore-identity" }, "sameCompany": [ "amazon-nova-embeddings", "amazon-bedrock-guardrails", "amazon-transcribe", "amazon-polly", "agentcore-memory", "aws-secrets-manager", "aws-mcp-servers", "amazon-ses", "amazon-location", "amazon-translate", "amazon-ads-api" ], "area": "agent-runtime", "unitPrices": [ { "item": "OAuth token or API key requests for non-AWS resources", "unit": "1k-requests", "usd": 0.01, "note": "Per successful request. No charge when used through AgentCore Runtime or Gateway" } ], "provenance": { "legalEntity": "Amazon Web Services, Inc.", "domain": "amazon.com", "domainRegistered": "1994-11-01", "domainNote": "The service pages are under aws.amazon.com and the endpoints are on amazonaws.com, an AWS domain.", "endpointOnVendorDomain": true, "terms": "https://aws.amazon.com/service-terms/", "privacy": "https://aws.amazon.com/privacy/", "statusPage": "https://health.aws.amazon.com/health/status", "changelog": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/release-notes.html", "securityTxt": "expired", "checked": "2026-10-08", "notes": [ "The AWS Service Terms show Last Updated 1 October 2026. Section 50 covers AI services and section 50.15 covers AgentCore Payments. No section names AgentCore Identity, so the universal terms and section 50 apply.", "The Privacy Notice shows Last Updated 18 May 2026 and gives Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210.", "security.txt shows Expires 2026-09-24T16:25:03Z, read on 8 October 2026. It points to the AWS vulnerability disclosure programme on HackerOne and the policy at vdp.aws.security.", "The status page is drawn by script. We read the per-service feed (status.aws.amazon.com/rss/bedrock-agentcore-us-east-1.rss, no items) and the dashboard's history file.", "The domain registration date is carried from our other AWS listings. WHOIS was not reachable from this session.", "The release notes are dated by month only, and the RSS feed they mention was not found at doc-history.rss (404)." ], "score": 88 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/agentcore-identity.json", "live": { "slug": "agentcore-identity", "probe": { "target": "https://bedrock-agentcore.us-east-1.amazonaws.com", "method": "get", "lastAt": "2026-10-09T11:46:20.684653607Z", "lastOk": true, "lastStatus": 404, "lastMs": 255, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 255, "p95ms24h": 294, "samples24h": 44, "samples30d": 44, "days": [ { "date": "2026-10-09", "probes": 44, "ok": 44 } ] }, "updatedAt": "2026-10-09T11:46:20.684653607Z" } }, "answer": "Amazon Bedrock AgentCore Identity scores 74.8 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 71.4 (BB), and leads in 3 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on transparency \u0026 trust.", "b": { "slug": "auth0-ai-agents", "name": "Auth0 for AI Agents (Token Vault)", "vendor": "Auth0 by Okta", "vendorUrl": "https://auth0.com/ai", "kind": "http-api", "category": "agent-auth", "summary": "Auth0's identity and authorisation tools for AI agents, built on its identity platform.", "url": "https://www.anchorterminal.com/tools/auth0-ai-agents", "markdownUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json", "repo": "https://github.com/auth0/auth0-ai-js", "license": "Apache-2.0 (SDKs), platform closed", "transports": [ "http", "stdio" ], "remoteUrl": "https://{tenant}.auth0.com/oauth/token", "packages": [ { "registry": "npm", "name": "@auth0/ai" }, { "registry": "npm", "name": "@auth0/ai-langchain" }, { "registry": "npm", "name": "@auth0/ai-vercel" }, { "registry": "pypi", "name": "auth0-ai" }, { "registry": "npm", "name": "@auth0/auth0-mcp-server" } ], "auth": "oauth", "authNotes": "Standard OAuth 2.0 and OIDC against your tenant. The app exchanges the user's Auth0 refresh token or access token at /oauth/token with the grant type `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token` and gets back the external provider's access token. Backend workers can use a signed JWT (privileged worker exchange). DPoP can bind Auth0 tokens to the client. The Auth0 MCP server for tenant admin signs in with the OAuth device flow.", "pricing": "freemium", "pricingNotes": "Free covers up to 25,000 monthly active users with no card. Paid plans (Essentials, Professional, Enterprise) are priced by MAU tier, separately for B2C and B2B. Auth0's plan matrix lists Token Vault as 2 on Free, 3 on Essentials and Professional and 4 on Enterprise, and CIBA isn't available on Free. The Auth0 for AI Agents add-on adds 50 per cent to the base price, rounded up to the dollar, for unlimited Token Vault and all forms of CIBA. Yearly billing is 11 times the monthly price. Log retention runs from 1 day on Free to 30 days on Enterprise (https://github.com/auth0/docs-v2/blob/main/main/.mintlify/skills/auth0/references/feature-audit-pricing/index.md, https://auth0.com/pricing). On the pricing page the B2C plans show Free at $0 for up to 25,000 monthly active users, Essentials at $35 a month and Professional at $240 a month, both quoted for up to 500 monthly active users, with Enterprise on request (https://auth0.com/pricing).", "priceSummary": "Freemium", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 16, "npmWeekly": 3114, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://auth0.com/ai/docs", "llmsTxt": "https://auth0.com/ai/docs/llms.txt", "registryName": "com.auth0/mcp", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "hitl.approve" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "oauth", "typescript", "python", "enterprise", "mcp" ], "lastRelease": "2026-09-18", "graded": true, "anchor": { "graded": true, "score": 71.4, "grade": "BB", "agentReady": true, "rank": 120, "ranked": true, "rankOf": 842, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 74, "payments": 30, "reliability": 75, "schema": 73, "security": 88, "transparency": 84 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP. Only works when Auth0 is the identity provider for your users.", "bestFor": "Best when Auth0 already runs login and the agent needs a handful of the user's Google, Microsoft, Slack or GitHub tokens, or a second-device approval before a payment or delete.", "strengths": [ "Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP", "Human approval on a second device for sensitive actions, showing the exact payee or amount", "Free plan up to 25,000 monthly active users with no card", "Deprecations listed with announcement and end-of-life dates six to seven months apart", "Bugcrowd programme, valid security.txt and an Enterprise SLA of 99.99 per cent" ], "weaknesses": [ "Only works when Auth0 is the identity provider for your users", "Two Token Vault connections on Free and three on Essentials and Professional without the add-on", "Log retention of 1 day on Free and 5 days on Essentials is short for an audit trail", "No OpenAPI schema for the Authentication API that the exchange uses", "Agent SDKs last released in April 2026 (JavaScript) and January 2026 (Python)" ], "agentNotes": [ "Turn off refresh token rotation on the application before using the refresh token exchange", "Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow", "Pass login_hint when a user has linked two accounts from the same provider", "Use CIBA for purchases or deletes and wait for the approval instead of asking in chat", "Read X-RateLimit-Reset on a 429 and back off until then" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 71.4 } ], "editorialScores": { "ergonomics": 71, "maintenance": 74, "payments": 30, "reliability": 75, "schema": 73, "security": 88, "transparency": 70 }, "provenanceScore": 97 }, "connect": { "install": "npm install @auth0/ai", "http": "curl -X POST \"https://$AUTH0_DOMAIN/oauth/token\" \\\n -d grant_type=urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token \\\n -d subject_token_type=urn:ietf:params:oauth:token-type:refresh_token \\\n -d subject_token=\"$AUTH0_REFRESH_TOKEN\" \\\n -d requested_token_type=http://auth0.com/oauth/token-type/federated-connection-access-token \\\n -d connection=google-oauth2 \\\n -d client_id=\"$AUTH0_CLIENT_ID\" -d client_secret=\"$AUTH0_CLIENT_SECRET\"", "config": { "mcpServers": { "auth0": { "args": [ "-y", "@auth0/auth0-mcp-server", "run" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/auth0-ai-agents" }, "area": "agent-runtime", "provenance": { "legalEntity": "Okta, Inc.", "domain": "auth0.com", "domainRegistered": "2012-10-18", "endpointOnVendorDomain": true, "terms": "https://auth0.com/legal", "privacy": "https://www.okta.com/privacy-policy/", "statusPage": "https://status.auth0.com", "changelog": "https://auth0.com/changelog", "securityTxt": "valid", "checked": "2026-09-30", "notes": [ "We couldn't read the terms page on 2026-09-30.", "The Auth0 MCP server (@auth0/auth0-mcp-server, version 0.1.0-beta.19) manages your tenant. It isn't how an agent gets user tokens." ], "score": 97 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.json", "live": { "slug": "auth0-ai-agents", "probe": { "target": "https://{tenant}.auth0.com/oauth/token", "method": "get", "lastAt": "2026-10-09T11:46:22.404365333Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "invalid character \"{\" in host name", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 259, "samples30d": 2109, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 0 }, { "date": "2026-10-02", "probes": 248, "ok": 0 }, { "date": "2026-10-03", "probes": 271, "ok": 0 }, { "date": "2026-10-04", "probes": 272, "ok": 0 }, { "date": "2026-10-05", "probes": 272, "ok": 0 }, { "date": "2026-10-06", "probes": 272, "ok": 0 }, { "date": "2026-10-07", "probes": 272, "ok": 0 }, { "date": "2026-10-08", "probes": 268, "ok": 0 }, { "date": "2026-10-09", "probes": 125, "ok": 0 } ] }, "vendorStatus": { "page": "https://status.auth0.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-09T07:57:38.123654169Z" }, "versions": [ { "registry": "github", "name": "auth0/auth0-ai-js", "version": "@auth0/ai-vercel-v5.1.1", "released": "2026-04-22", "seenAt": "2026-10-08T16:00:16.881579068Z" }, { "registry": "mcp-registry", "name": "com.auth0/mcp", "version": "0.1.0-beta.10", "seenAt": "2026-10-09T02:57:46.004536428Z" }, { "registry": "npm", "name": "@auth0/ai", "version": "6.0.2", "seenAt": "2026-10-08T16:00:07.151271236Z" }, { "registry": "npm", "name": "@auth0/ai-langchain", "version": "5.0.2", "seenAt": "2026-10-08T16:00:11.11785045Z" }, { "registry": "npm", "name": "@auth0/ai-vercel", "version": "5.1.1", "seenAt": "2026-10-08T16:00:11.491195505Z" }, { "registry": "npm", "name": "@auth0/auth0-mcp-server", "version": "0.1.0-beta.19", "seenAt": "2026-10-08T16:00:16.635027644Z" }, { "registry": "pypi", "name": "auth0-ai", "version": "1.0.2", "released": "2026-01-20", "seenAt": "2026-10-08T16:00:13.354695893Z" } ], "githubStars": 16, "npmWeekly": 5756, "pypiWeekly": 204, "securityTxt": { "url": "https://auth0.com/.well-known/security.txt", "state": "valid", "expires": "2027-01-01T08:00:00.000Z", "checkedAt": "2026-10-08T15:38:39.123462908Z" }, "llmsTxt": { "url": "https://auth0.com/ai/docs/llms.txt", "ok": false, "status": 404, "checkedAt": "2026-10-08T14:00:04.745442501Z" }, "domain": { "domain": "auth0.com", "registered": "2012-10-18", "source": "https://rdap.verisign.com/com/v1/domain/auth0.com", "checkedAt": "2026-10-04T13:06:20.951498912Z" }, "pages": [ { "url": "https://auth0.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:15:26.779773705Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2ecd4d6660eb" }, { "url": "https://auth0.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-10-08T18:15:29.251984813Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8730de5a8d15" }, { "url": "https://raw.githubusercontent.com/auth0/docs-v2/main/main/.mintlify/skills/auth0/references/feature-audit-pricing/index.md", "kind": "pricing", "status": 304, "checkedAt": "2026-10-08T18:23:59.779721296Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d3bbfc00df65" }, { "url": "https://www.okta.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:29:25.460956149Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "be09b03a3016" }, { "url": "https://auth0.com/legal", "kind": "terms", "status": 0, "checkedAt": "2026-10-08T18:15:29.251971584Z", "changedAt": "0001-01-01T00:00:00Z", "blockedByRobots": true } ], "updatedAt": "2026-10-09T11:46:22.404365333Z" } }, "facts": [ { "a": "HTTP API", "b": "HTTP API", "name": "Kind" }, { "a": "Amazon Web Services", "b": "Auth0 by Okta", "name": "Vendor" }, { "a": "https://bedrock-agentcore.us-east-1.amazonaws.com", "b": "https://{tenant}.auth0.com/oauth/token", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "HTTP, stdio", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth", "name": "Auth" }, { "a": "Pay per use", "b": "Freemium", "name": "Pricing" }, { "a": "$0.01 per 1,000 requests", "b": "not published", "name": "Price for auth oauth" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service under the AWS Customer Agreement and AWS Service Terms. The AgentCore SDKs for Python and TypeScript are Apache-2.0", "b": "Apache-2.0 (SDKs), platform closed", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "com.auth0/mcp", "name": "MCP registry" }, { "a": "2026-09-01", "b": "2026-09-18", "name": "Last release" }, { "a": "2026-10-01", "b": "couldn't be read", "name": "Terms last updated" }, { "a": "2026-05-18", "b": "2026-06-01", "name": "Privacy policy last updated" }, { "a": "yes, with an opt-out", "b": "couldn't be read", "name": "Customer content may train models" }, { "a": "yes", "b": "couldn't be read", "name": "Terms restrict automated access" }, { "a": "yes", "b": "couldn't be read", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "couldn't be read", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "couldn't be read", "name": "Arbitration or class-action waiver" }, { "a": "335k npm/wk, 1.4M PyPI/wk", "b": "16 stars, 3.1k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Amazon Bedrock AgentCore Identity scores 74.8 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 71.4 (BB), and leads in 3 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on transparency \u0026 trust.", "question": "Which is better for AI agents, Amazon Bedrock AgentCore Identity or Auth0 for AI Agents (Token Vault)?" }, { "answer": "Amazon Bedrock AgentCore Identity takes an API key or an OAuth sign-in. Auth0 for AI Agents (Token Vault) uses an OAuth sign-in.", "question": "Do Amazon Bedrock AgentCore Identity and Auth0 for AI Agents (Token Vault) need an API key?" }, { "answer": "Yes. Amazon Bedrock AgentCore Identity has a hosted endpoint at https://bedrock-agentcore.us-east-1.amazonaws.com and Auth0 for AI Agents (Token Vault) at https://{tenant}.auth0.com/oauth/token.", "question": "Can an agent call Amazon Bedrock AgentCore Identity and Auth0 for AI Agents (Token Vault) without installing anything?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 85 against 75", "Schema \u0026 documentation, 88 against 73", "Agent ergonomics, 76 against 71" ], "also": null, "goodFor": "Agents already built on AWS, above all those on AgentCore Runtime or Gateway, where token retrieval is automatic and free of extra charge.", "slug": "agentcore-identity", "watchFor": "No operation to revoke or delete one user's stored grant was found. `forceAuthentication` clears a refresh token, and AWS says it cannot detect a revocation made at the provider." }, { "aheadOn": [ "Transparency \u0026 trust, 84 against 75" ], "also": [ "Runs on your own machine", "Free to start without a card" ], "goodFor": "Best when Auth0 already runs login and the agent needs a handful of the user's Google, Microsoft, Slack or GitHub tokens, or a second-device approval before a payment or delete.", "slug": "auth0-ai-agents", "watchFor": "Only works when Auth0 is the identity provider for your users" } ], "job": { "capability": "auth.oauth", "name": "Auth oauth" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-agentcore-identity.json", "title": "Aembit vs Amazon Bedrock AgentCore Identity", "url": "https://www.anchorterminal.com/compare/aembit-vs-agentcore-identity" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents.json", "title": "Aembit vs Auth0 for AI Agents (Token Vault)", "url": "https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade.json", "title": "Amazon Bedrock AgentCore Identity vs Arcade.dev", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-descope-agentic-identity.json", "title": "Amazon Bedrock AgentCore Identity vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard.json", "title": "Amazon Bedrock AgentCore Identity vs Keycard", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id.json", "title": "Amazon Bedrock AgentCore Identity vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-nango.json", "title": "Amazon Bedrock AgentCore Identity vs Nango", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.json", "title": "Amazon Bedrock AgentCore Identity vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-stytch-connected-apps.json", "title": "Amazon Bedrock AgentCore Identity vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.json", "title": "Amazon Bedrock AgentCore Identity vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-workos-pipes.json", "title": "Amazon Bedrock AgentCore Identity vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.json", "title": "Arcade.dev vs Auth0 for AI Agents (Token Vault)", "url": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity.json", "title": "Auth0 for AI Agents (Token Vault) vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.json", "title": "Auth0 for AI Agents (Token Vault) vs Keycard", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id.json", "title": "Auth0 for AI Agents (Token Vault) vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango.json", "title": "Auth0 for AI Agents (Token Vault) vs Nango", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit.json", "title": "Auth0 for AI Agents (Token Vault) vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.json", "title": "Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.json", "title": "Auth0 for AI Agents (Token Vault) vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes.json", "title": "Auth0 for AI Agents (Token Vault) vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes" } ], "scores": [ { "agentcore-identity": 85, "auth0-ai-agents": 75, "by": 10, "edge": "agentcore-identity", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "agentcore-identity": 88, "auth0-ai-agents": 73, "by": 15, "edge": "agentcore-identity", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "agentcore-identity": 76, "auth0-ai-agents": 71, "by": 5, "edge": "agentcore-identity", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "agentcore-identity": 84, "auth0-ai-agents": 88, "by": 4, "edge": "auth0-ai-agents", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "agentcore-identity": 30, "auth0-ai-agents": 30, "by": 0, "edge": "", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "agentcore-identity": 70, "auth0-ai-agents": 74, "by": 4, "edge": "auth0-ai-agents", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "agentcore-identity": 75, "auth0-ai-agents": 84, "by": 9, "edge": "auth0-ai-agents", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Amazon Bedrock AgentCore Identity scores 74.8 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 71.4 (BB), and leads in 3 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on transparency \u0026 trust. Both do auth oauth.", "verdicts": { "agentcore-identity": "The service handles user-delegated, machine-to-machine and on-behalf-of token flows through one call, with IAM scoping, KMS encryption and published quotas. It only works inside an AWS account a person creates, the hosted consent portal needs an AgentCore Gateway, and no call to revoke one user's stored grant was found in the API reference.", "auth0-ai-agents": "Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP. Only works when Auth0 is the identity provider for your users." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents", "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.md", "slim": "https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.min.md" }, "markdown": "Amazon Bedrock AgentCore Identity scores 74.8 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 71.4 (BB), and leads in 3 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on transparency \u0026 trust. Both do auth oauth.\n\n- Amazon Bedrock AgentCore Identity: grade BB, 74.8/100, rank #64 of 842. Markdown https://www.anchorterminal.com/tools/agentcore-identity.md · JSON https://www.anchorterminal.com/api/v1/tools/agentcore-identity.json\n- Auth0 for AI Agents (Token Vault): grade BB, 71.4/100, rank #120 of 842. Markdown https://www.anchorterminal.com/tools/auth0-ai-agents.md · JSON https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json\n\n## Which one, for what\n\n### Amazon Bedrock AgentCore Identity (BB)\n\nGood for: Agents already built on AWS, above all those on AgentCore Runtime or Gateway, where token retrieval is automatic and free of extra charge.\n\nAhead on:\n- Reliability, 85 against 75\n- Schema \u0026 documentation, 88 against 73\n- Agent ergonomics, 76 against 71\n\nWatch for: No operation to revoke or delete one user's stored grant was found. `forceAuthentication` clears a refresh token, and AWS says it cannot detect a revocation made at the provider.\n\n### Auth0 for AI Agents (Token Vault) (BB)\n\nGood for: Best when Auth0 already runs login and the agent needs a handful of the user's Google, Microsoft, Slack or GitHub tokens, or a second-device approval before a payment or delete.\n\nAhead on:\n- Transparency \u0026 trust, 84 against 75\n\nAlso in its favour:\n- Runs on your own machine\n- Free to start without a card\n\nWatch for: Only works when Auth0 is the identity provider for your users\n\n\n## Score by category\n\n| Category | Weight | Amazon Bedrock AgentCore Identity | Auth0 for AI Agents (Token Vault) | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 85 | 75 | Amazon Bedrock AgentCore Identity +10 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 88 | 73 | Amazon Bedrock AgentCore Identity +15 |\n| Agent ergonomics | 13% (16.2 this run) | 76 | 71 | Amazon Bedrock AgentCore Identity +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 84 | 88 | Auth0 for AI Agents (Token Vault) +4 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 30 | even |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 70 | 74 | Auth0 for AI Agents (Token Vault) +4 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 75 | 84 | Auth0 for AI Agents (Token Vault) +9 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **74.8 · BB** | **71.4 · BB** | |\n\n## Facts side by side\n\n| Fact | Amazon Bedrock AgentCore Identity | Auth0 for AI Agents (Token Vault) |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Amazon Web Services | Auth0 by Okta |\n| Hosted endpoint | `https://bedrock-agentcore.us-east-1.amazonaws.com` | `https://{tenant}.auth0.com/oauth/token` |\n| Transports | HTTP | HTTP, stdio |\n| Auth | OAuth or key | OAuth |\n| Pricing | Pay per use | Freemium |\n| Price for auth oauth | $0.01 per 1,000 requests | not published |\n| x402 | no | no |\n| Licence | Proprietary service under the AWS Customer Agreement and AWS Service Terms. The AgentCore SDKs for Python and TypeScript are Apache-2.0 | Apache-2.0 (SDKs), platform closed |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | `com.auth0/mcp` |\n| Last release | 2026-09-01 | 2026-09-18 |\n| Terms last updated | 2026-10-01 | couldn't be read |\n| Privacy policy last updated | 2026-05-18 | 2026-06-01 |\n| Customer content may train models | yes, with an opt-out | couldn't be read |\n| Terms restrict automated access | yes | couldn't be read |\n| Terms restrict benchmarking | yes | couldn't be read |\n| Terms or service can change without notice | yes | couldn't be read |\n| Arbitration or class-action waiver | not found in the text | couldn't be read |\n| Popularity | 335k npm/wk, 1.4M PyPI/wk | 16 stars, 3.1k npm/wk |\n| Agent reviews | none | 3.5/5 (2) |\n\n## Verdicts\n\n**Amazon Bedrock AgentCore Identity.** The service handles user-delegated, machine-to-machine and on-behalf-of token flows through one call, with IAM scoping, KMS encryption and published quotas. It only works inside an AWS account a person creates, the hosted consent portal needs an AgentCore Gateway, and no call to revoke one user's stored grant was found in the API reference.\n\n**Auth0 for AI Agents (Token Vault).** Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP. Only works when Auth0 is the identity provider for your users.\n\n## Before you call either\n\n### Amazon Bedrock AgentCore Identity\n\n1. Get a workload access token first (`GetWorkloadAccessTokenForJWT` in production), then pass it as `workloadIdentityToken` to `GetResourceOauth2Token` or `GetResourceApiKey`.\n2. When `GetResourceOauth2Token` returns `authorizationUrl` instead of `accessToken`, send the URL to the user and call again with the same `sessionUri` after consent.\n3. For user-delegated flows, host an HTTPS callback, register it with `UpdateWorkloadIdentity` as an allowed return URL, and call `CompleteResourceTokenAuth` after checking the user's session.\n4. Ask for refresh tokens in the provider's own way, such as `access_type=offline` in `customParameters` for Google or the `offline_access` scope for Microsoft and Atlassian.\n5. Treat a returned token as possibly revoked. On a 401 from the resource server, retry with `forceAuthentication` set to true.\n\n### Auth0 for AI Agents (Token Vault)\n\n1. Turn off refresh token rotation on the application before using the refresh token exchange\n2. Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow\n3. Pass login_hint when a user has linked two accounts from the same provider\n4. Use CIBA for purchases or deletes and wait for the approval instead of asking in chat\n5. Read X-RateLimit-Reset on a 429 and back off until then\n\n## Questions\n\n### Which is better for AI agents, Amazon Bedrock AgentCore Identity or Auth0 for AI Agents (Token Vault)?\n\nAmazon Bedrock AgentCore Identity scores 74.8 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 71.4 (BB), and leads in 3 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on transparency \u0026 trust.\n\n### Do Amazon Bedrock AgentCore Identity and Auth0 for AI Agents (Token Vault) need an API key?\n\nAmazon Bedrock AgentCore Identity takes an API key or an OAuth sign-in. Auth0 for AI Agents (Token Vault) uses an OAuth sign-in.\n\n### Can an agent call Amazon Bedrock AgentCore Identity and Auth0 for AI Agents (Token Vault) without installing anything?\n\nYes. Amazon Bedrock AgentCore Identity has a hosted endpoint at https://bedrock-agentcore.us-east-1.amazonaws.com and Auth0 for AI Agents (Token Vault) at https://{tenant}.auth0.com/oauth/token.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.json, and with the fewest tokens: https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"agentcore-identity\", \"b\": \"auth0-ai-agents\"}`. From a terminal: `anchor compare agentcore-identity auth0-ai-agents`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/agentcore-identity.json and https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json\n\n## Other comparisons with Amazon Bedrock AgentCore Identity or Auth0 for AI Agents (Token Vault)\n\n- [Aembit vs Amazon Bedrock AgentCore Identity](https://www.anchorterminal.com/compare/aembit-vs-agentcore-identity.md)\n- [Aembit vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents.md)\n- [Amazon Bedrock AgentCore Identity vs Arcade.dev](https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade.md)\n- [Amazon Bedrock AgentCore Identity vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/agentcore-identity-vs-descope-agentic-identity.md)\n- [Amazon Bedrock AgentCore Identity vs Keycard](https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard.md)\n- [Amazon Bedrock AgentCore Identity vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id.md)\n- [Amazon Bedrock AgentCore Identity vs Nango](https://www.anchorterminal.com/compare/agentcore-identity-vs-nango.md)\n- [Amazon Bedrock AgentCore Identity vs Scalekit AgentKit](https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.md)\n- [Amazon Bedrock AgentCore Identity vs Stytch Connected Apps](https://www.anchorterminal.com/compare/agentcore-identity-vs-stytch-connected-apps.md)\n- [Amazon Bedrock AgentCore Identity vs Vercel Connect](https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.md)\n- [Amazon Bedrock AgentCore Identity vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/agentcore-identity-vs-workos-pipes.md)\n- [Arcade.dev vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.md)\n- [Auth0 for AI Agents (Token Vault) vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity.md)\n- [Auth0 for AI Agents (Token Vault) vs Keycard](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.md)\n- [Auth0 for AI Agents (Token Vault) vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id.md)\n- [Auth0 for AI Agents (Token Vault) vs Nango](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango.md)\n- [Auth0 for AI Agents (Token Vault) vs Scalekit AgentKit](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit.md)\n- [Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.md)\n- [Auth0 for AI Agents (Token Vault) vs Vercel Connect](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.md)\n- [Auth0 for AI Agents (Token Vault) vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-09", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Amazon Bedrock AgentCore Identity vs Auth0 for AI Agents (Token Vault)", "url": "" } ], "description": "Amazon Bedrock AgentCore Identity scores 74.8 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 71.4 (BB), and leads in 3 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on transparency \u0026 trust. Both do auth oauth. Category scores, facts…", "facts": [ "Amazon Bedrock AgentCore Identity BB 74.8", "Auth0 for AI Agents (Token Vault) BB 71.4", "scores" ], "h1": "Amazon Bedrock AgentCore Identity vs Auth0 for AI Agents (Token Vault)", "image": "https://www.anchorterminal.com/assets/og/compare-agentcore-identity-vs-auth0-ai-agents.png", "path": "/compare/agentcore-identity-vs-auth0-ai-agents", "published": "2026-10-01", "section": "tools", "title": "Amazon Bedrock AgentCore Identity vs Auth0 for AI Agents (Token Vault)", "toc": null, "updated": "2026-10-09", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents" }, "tokens": { "markdown": 2750, "slim": 830 }, "version": 1 }