Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider

Amazon Bedrock AgentCore Identity 30

No x402, MPP or L402 for paying AWS. AgentCore payments is a separate capability for agents paying third parties (0). $0.010 per 1,000 token or API key requests on the public pricing page, re-read on 1 November, with no extra charge through AgentCore Runtime or Gateway (20). No Identity free tier, but new accounts get up to $200 of Free Tier credit and the Free Tier FAQ, re-read on 1 November, says most new customers need no payment method, while AWS may still ask for one, so half, as on our other AWS listings (10). A person creates the AWS account and registers an OAuth client with each provider (0). 0 + 20 + 10 + 0 = 30.

Cloudflare Workers OAuth Provider 50

Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.

Amazon Bedrock AgentCore Identity 85

AWS Health Dashboard with a per-service, per-Region feed for Bedrock AgentCore (20). The us-east-1 and us-west-2 AgentCore feeds had no items on 1 November 2026 (last built 31 October). The dashboard's history file, re-read on 1 November, still lists one event naming AgentCore in the 90 days from 3 August, elevated packet loss in one Availability Zone of eu-south-2 on 4 October 2026 from 8:48 to 11:28 AM PDT, at informational status and shared with 31 other services. The only later entry is an API Gateway HTTP API error event in us-west-2 posted on 30 October, which doesn't name AgentCore. Minor only (20 of 30). Quotas published per operation, re-read on 1 November, 200 requests a second for GetResourceOauth2Token and the workload access token calls and 20 for management calls (15). The API reference documents ThrottlingException (429) and InternalServerException (500) with advice to retry with exponential backoff, but CreateWorkloadIdentity still takes no idempotency token in the service model read on 1 November (12 of 15). The AgentCore FAQ says the Amazon Bedrock SLA applies, 99.9 per cent a Region, though that SLA's definitions speak of model APIs and do not name AgentCore, per the 17 October check (8 of 10, our call). Generally available since October 2025, and the consent portal carries no preview label (10). 20 + 20 + 15 + 12 + 8 + 10 = 85.

Cloudflare Workers OAuth Provider 74

Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.

Amazon Bedrock AgentCore Identity 78

Closed service under the AWS Service Terms, last updated 30 October 2026 and re-read on 1 November, with Apache-2.0 SDKs (15 of 30). The Identity data protection pages state KMS encryption at rest with an optional customer managed key and warn that names and free-text fields can reach diagnostic logs. The privacy notice is dated 18 May 2026 (re-read). No retention period for stored tokens or request metadata was found (20 of 30). No deprecation policy for the service found. The one dated notice we saw is the starter toolkit's deprecation on 27 March 2026, in a security bulletin (8 of 20). A sub-processor list updated 30 October 2026 and regional endpoints in 21 Regions, with the vault held in the Region the owner picks (18 of 20). 15 + 20 + 8 + 18 = 61.

Cloudflare Workers OAuth Provider 86

MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating resolveExternalToken, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.