{ "data": { "a": { "slug": "agentcore-identity", "name": "Amazon Bedrock AgentCore Identity", "vendor": "Amazon Web Services", "vendorUrl": "https://aws.amazon.com/bedrock/agentcore/", "kind": "http-api", "category": "agent-auth", "summary": "Amazon Bedrock AgentCore Identity is an AWS service that gives agents workload identities, stores OAuth tokens and API keys in a token vault, and runs OAuth flows so agents can call third-party services for users or for themselves.", "url": "https://www.anchorterminal.com/tools/agentcore-identity", "markdownUrl": "https://www.anchorterminal.com/tools/agentcore-identity.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/agentcore-identity.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/agentcore-identity.json", "dns": "agentcore-identity.grade.anchorterminal.com", "repo": "https://github.com/aws/bedrock-agentcore-sdk-python", "license": "Proprietary service under the AWS Customer Agreement and AWS Service Terms. The AgentCore SDKs for Python and TypeScript are Apache-2.0", "transports": [ "http" ], "remoteUrl": "https://bedrock-agentcore.us-east-1.amazonaws.com", "packages": [ { "registry": "pypi", "name": "bedrock-agentcore" }, { "registry": "npm", "name": "bedrock-agentcore" }, { "registry": "npm", "name": "@aws-sdk/client-bedrock-agentcore" }, { "registry": "pypi", "name": "boto3" } ], "auth": "mixed", "authNotes": "A person creates an AWS account and an IAM role. Control-plane calls (`bedrock-agentcore-control`) and data-plane calls (`bedrock-agentcore`) are SigV4-signed with IAM credentials, and the data plane also documents an OAuth bearer route (`UnauthorizedException` for an invalid JWT). The agent first gets a workload access token that carries its own identity and the user's, from a JWT (`GetWorkloadAccessTokenForJWT`), a user ID string (`GetWorkloadAccessTokenForUserId`) or neither (`GetWorkloadAccessToken`), then exchanges it for a third-party OAuth token or API key. Each third-party provider needs an OAuth client the owner registers with that provider. AgentCore Runtime and Gateway fetch the workload access token for the agent.", "pricing": "usage", "pricingNotes": "$0.010 per 1,000 OAuth token or API key requests for non-AWS resources, billed per successful request, with no minimum fee. No additional charge when the service is used through AgentCore Runtime or AgentCore Gateway, which are billed on their own meters. No free tier specific to Identity was found. New AWS accounts get up to $200 of Free Tier credit for up to 6 months, and AWS says most new customers need no payment method at sign-up though it may ask for one (https://aws.amazon.com/bedrock/agentcore/pricing/, https://aws.amazon.com/free/free-tier-faqs/).", "priceSummary": "$0.01 / 1k req", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 for paying AWS on the pricing page or in the docs. AgentCore payments is a separate capability for agents paying third-party sellers (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": 334717, "pypiWeekly": 1421946, "asOf": "2026-10-08" }, "docsUrl": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity.html", "llmsTxt": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/llms.txt", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "auth.audit", "infra.aws" ], "tags": [ "hosted", "closed-source", "usage-priced", "oauth", "llms-txt", "python", "typescript", "enterprise", "sla", "soc2", "eu" ], "lastRelease": "2026-10-27", "graded": true, "anchor": { "graded": true, "score": 76.4, "grade": "BB", "agentReady": true, "rank": 44, "ranked": true, "rankOf": 1486, "categoryRank": 3, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 76, "maintenance": 85, "payments": 30, "reliability": 85, "schema": 88, "security": 84, "transparency": 78 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "The service handles user-delegated, machine-to-machine and on-behalf-of token flows through one call, with IAM scoping, KMS encryption and published quotas. It only works inside an AWS account a person creates, the hosted consent portal needs an AgentCore Gateway, and no call to revoke one user's stored grant was found in the API reference.", "bestFor": "Agents already built on AWS, above all those on AgentCore Runtime or Gateway, where token retrieval is automatic and free of extra charge.", "strengths": [ "`GetResourceOauth2Token` covers three flows (USER_FEDERATION, M2M and ON_BEHALF_OF_TOKEN_EXCHANGE) and returns either an access token or an authorisation URL with a session URI.", "25 OAuth vendor values in `CreateOauth2CredentialProvider`, 24 built in (Google, GitHub, Slack, Salesforce, Microsoft, Atlassian and others) plus a custom OAuth 2.0 provider.", "Quotas are published per operation, 200 requests a second for the three workload access token calls and 20 for each management call, all adjustable.", "The token vault is encrypted with an AWS owned KMS key by default or a customer managed key, and IAM policies can name one workload identity and one credential provider.", "$0.010 per 1,000 token or API key requests, with no extra charge when used through AgentCore Runtime or Gateway." ], "weaknesses": [ "No operation to revoke or delete one user's stored grant was found. `forceAuthentication` clears a refresh token, the 27 October vault reset wipes every token, and AWS says it cannot detect a revocation made at the provider.", "The consent portal, launched 1 September 2026, attaches to one AgentCore Gateway with JWT inbound auth and cannot use GitHub, Slack, Salesforce, Atlassian or LinkedIn as its sign-in provider.", "`GetWorkloadAccessTokenForUserId` takes a user ID string the platform does not verify, so the binding to a user rests on the caller and its IAM policy.", "AWS states the service enforces no binding between workload identities and credential providers in one account beyond the IAM policy the owner writes.", "No CloudTrail page for AgentCore Identity was found in the developer guide, though Gateway and Agent Registry each have one." ], "agentNotes": [ "Get a workload access token first (`GetWorkloadAccessTokenForJWT` in production), then pass it as `workloadIdentityToken` to `GetResourceOauth2Token` or `GetResourceApiKey`.", "When `GetResourceOauth2Token` returns `authorizationUrl` instead of `accessToken`, send the URL to the user and call again with the same `sessionUri` after consent.", "For user-delegated flows, host an HTTPS callback, register it with `UpdateWorkloadIdentity` as an allowed return URL, and call `CompleteResourceTokenAuth` after checking the user's session.", "Ask for refresh tokens in the provider's own way, such as `access_type=offline` in `customParameters` for Google or the `offline_access` scope for Microsoft and Atlassian.", "Treat a returned token as possibly revoked. On a 401 from the resource server, retry with `forceAuthentication` set to true." ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 4, "avgRating": 3.3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.4 } ], "editorialScores": { "ergonomics": 76, "maintenance": 85, "payments": 30, "reliability": 85, "schema": 88, "security": 84, "transparency": 61 }, "provenanceScore": 94, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install bedrock-agentcore" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/agentcore-identity" }, "sameCompany": [ "amazon-bedrock", "amazon-nova-embeddings", "amazon-bedrock-guardrails", "amazon-transcribe", "amazon-polly", "amazon-nova-sonic", "agentcore-memory", "aws-secrets-manager", "agentcore-web-search", "aws-mcp-servers", "amazon-ses", "amazon-location", "amazon-translate", "amazon-ads-api", "amazon-creators-api" ], "area": "agent-runtime", "unitPrices": [ { "item": "OAuth token or API key requests for non-AWS resources", "unit": "1k-requests", "usd": 0.01, "note": "Per successful request. No charge when used through AgentCore Runtime or Gateway" } ], "provenance": { "legalEntity": "Amazon Web Services, Inc.", "domain": "amazon.com", "domainRegistered": "1994-11-01", "domainNote": "The service pages are under aws.amazon.com and the endpoints are on amazonaws.com, an AWS domain.", "endpointOnVendorDomain": true, "terms": "https://aws.amazon.com/service-terms/", "privacy": "https://aws.amazon.com/privacy/", "statusPage": "https://health.aws.amazon.com/health/status", "changelog": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/release-notes.html", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "The AWS Service Terms show Last Updated 30 October 2026, read on 1 November. Section 50 covers AI services and section 50.15 covers AgentCore Payments. No section names AgentCore Identity, so the universal terms and section 50 apply.", "The Privacy Notice shows Last Updated 18 May 2026 (re-read on 1 November) and gives Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, per the 8 October check.", "security.txt shows Expires 2027-10-16T16:25:03Z, read on 1 November 2026. It points to the AWS vulnerability disclosure programme on HackerOne and the policy at vdp.aws.security.", "The status page is drawn by script. We read the dashboard's history file and the per-service feeds for us-east-1 and us-west-2 (no items) on 1 November.", "The domain registration date is carried from our other AWS listings. WHOIS was not reachable from this session.", "The release notes are dated by month only, and the RSS feed they mention was not found at doc-history.rss (404)." ], "score": 94 }, "requirements": { "setupChecked": true, "complianceChecked": true, "card": "unknown", "freeTier": true, "minutes": 30, "credential": "cloud-iam", "hosting": [ "US", "EU", "UK", "CA", "APAC" ], "euResidency": "yes", "trainsOnData": "unknown", "zeroRetention": "no", "certifications": [ "SOC 2 Type II", "ISO 27001", "ISO 27701", "HIPAA (BAA available)", "FedRAMP", "CSA STAR", "GDPR" ], "dpa": true, "selfHost": "no" }, "pageJsonUrl": "https://www.anchorterminal.com/tools/agentcore-identity.json", "live": { "slug": "agentcore-identity", "probe": { "target": "https://bedrock-agentcore.us-east-1.amazonaws.com", "method": "get", "lastAt": "2026-11-07T18:20:08.661049571Z", "lastOk": true, "lastStatus": 404, "lastMs": 307, "authRequired": false, "uptime24h": 100, "uptime30d": 99.97, "p50ms24h": 266, "p95ms24h": 357, "samples24h": 239, "samples30d": 7289, "days": [ { "date": "2026-10-09", "probes": 169, "ok": 169 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 246 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 248, "ok": 248 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://health.aws.amazon.com/health/status", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-06T05:41:04.418092502Z" }, "versions": [ { "registry": "github", "name": "aws/bedrock-agentcore-sdk-python", "version": "v1.25.4", "released": "2026-11-06", "seenAt": "2026-11-06T23:03:29.505614821Z" }, { "registry": "npm", "name": "@aws-sdk/client-bedrock-agentcore", "version": "3.1164.0", "seenAt": "2026-11-06T23:03:27.336515173Z" }, { "registry": "npm", "name": "bedrock-agentcore", "version": "0.4.6", "seenAt": "2026-11-06T23:03:27.286580602Z" }, { "registry": "pypi", "name": "bedrock-agentcore", "version": "1.25.4", "released": "2026-11-06", "seenAt": "2026-11-06T23:03:27.172846458Z" }, { "registry": "pypi", "name": "boto3", "version": "1.43.126", "released": "2026-11-06", "seenAt": "2026-11-06T23:03:29.475570858Z" } ], "githubStars": 783, "npmWeekly": 354952, "pypiWeekly": 1658205, "securityTxt": { "url": "https://amazon.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:18.354437696Z" }, "llmsTxt": { "url": "https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:07.635151704Z" }, "domain": { "domain": "amazon.com", "registered": "1994-11-01", "source": "https://rdap.verisign.com/com/v1/domain/amazon.com", "checkedAt": "2026-11-01T14:09:08.477101866Z" }, "github": { "repo": "aws/bedrock-agentcore-sdk-python", "checkedAt": "2026-11-02T08:33:22.483521011Z", "stars": 782, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-30T13:45:55Z", "openIssues": 82, "openPRs": 51, "issuesOpened90d": 25, "issuesClosed90d": 13, "prsMerged90d": 46, "ci": { "branch": "main", "runs": 50, "success": 45, "failure": 5, "other": 0, "latest": "success", "latestAt": "2026-10-30T13:47:31Z" }, "advisories": [ { "ghsa": "GHSA-j6g5-3hh3-pgw8", "cve": "CVE-2026-16796", "severity": "high", "published": "2026-07-23T20:11:08Z" }, { "ghsa": "GHSA-hqf8-7w95-9r33", "cve": "CVE-2026-15737", "severity": "medium", "published": "2026-07-16T17:05:36Z" }, { "ghsa": "GHSA-6rfw-mq36-jm8h", "cve": "CVE-2026-12530", "severity": "high", "published": "2026-06-17T21:10:20Z" } ], "replies": { "sampled": 25, "unanswered": 13, "medianDays": 9.9 } }, "updatedAt": "2026-11-07T18:20:08.661049571Z" } }, "answer": "Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider score within a point of each other on agent readiness, 76.4 (BB) and 76.2 (BB). Cloudflare Workers OAuth Provider leads on payments \u0026 pricing and transparency \u0026 trust.", "b": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:51.905590942Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T18:20:51.905590942Z" } }, "edges": [ { "by": 20, "category": "payments", "leads": "cloudflare-workers-oauth-provider", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 for paying AWS. AgentCore payments is a separate capability for agents paying third parties (0). $0.010 per 1,000 token or API key requests on the public pricing page, re-read on 1 November, with no extra charge through AgentCore Runtime or Gateway (20). No Identity free tier, but new accounts get up to $200 of Free Tier credit and the Free Tier FAQ, re-read on 1 November, says most new customers need no payment method, while AWS may still ask for one, so half, as on our other AWS listings (10). A person creates the AWS account and registers an OAuth client with each provider (0). 0 + 20 + 10 + 0 = 30.", "b": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50." }, "scores": { "a": 30, "b": 50 } }, { "by": 11, "category": "reliability", "leads": "agentcore-identity", "name": "Reliability", "reasons": { "a": "AWS Health Dashboard with a per-service, per-Region feed for Bedrock AgentCore (20). The us-east-1 and us-west-2 AgentCore feeds had no items on 1 November 2026 (last built 31 October). The dashboard's history file, re-read on 1 November, still lists one event naming AgentCore in the 90 days from 3 August, elevated packet loss in one Availability Zone of eu-south-2 on 4 October 2026 from 8:48 to 11:28 AM PDT, at informational status and shared with 31 other services. The only later entry is an API Gateway HTTP API error event in us-west-2 posted on 30 October, which doesn't name AgentCore. Minor only (20 of 30). Quotas published per operation, re-read on 1 November, 200 requests a second for `GetResourceOauth2Token` and the workload access token calls and 20 for management calls (15). The API reference documents `ThrottlingException` (429) and `InternalServerException` (500) with advice to retry with exponential backoff, but `CreateWorkloadIdentity` still takes no idempotency token in the service model read on 1 November (12 of 15). The AgentCore FAQ says the Amazon Bedrock SLA applies, 99.9 per cent a Region, though that SLA's definitions speak of model APIs and do not name AgentCore, per the 17 October check (8 of 10, our call). Generally available since October 2025, and the consent portal carries no preview label (10). 20 + 20 + 15 + 12 + 8 + 10 = 85.", "b": "Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74." }, "scores": { "a": 85, "b": 74 } }, { "by": 8, "category": "transparency", "leads": "cloudflare-workers-oauth-provider", "name": "Transparency \u0026 trust", "reasons": { "a": "Closed service under the AWS Service Terms, last updated 30 October 2026 and re-read on 1 November, with Apache-2.0 SDKs (15 of 30). The Identity data protection pages state KMS encryption at rest with an optional customer managed key and warn that names and free-text fields can reach diagnostic logs. The privacy notice is dated 18 May 2026 (re-read). No retention period for stored tokens or request metadata was found (20 of 30). No deprecation policy for the service found. The one dated notice we saw is the starter toolkit's deprecation on 27 March 2026, in a security bulletin (8 of 20). A sub-processor list updated 30 October 2026 and regional endpoints in 21 Regions, with the vault held in the Region the owner picks (18 of 20). 15 + 20 + 8 + 18 = 61.", "b": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77." }, "scores": { "a": 78, "b": 86 } } ], "facts": [ { "a": "HTTP API", "b": "SDK + MCP", "name": "Kind" }, { "a": "Amazon Web Services", "b": "Cloudflare", "name": "Vendor" }, { "a": "https://bedrock-agentcore.us-east-1.amazonaws.com", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP", "b": "", "name": "Transports" }, { "a": "OAuth or key", "b": "OAuth", "name": "Auth" }, { "a": "Pay per use", "b": "Free", "name": "Pricing" }, { "a": "$0.01 per 1,000 requests", "b": "free", "name": "Price for oauth for agents" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Proprietary service under the AWS Customer Agreement and AWS Service Terms. The AgentCore SDKs for Python and TypeScript are Apache-2.0", "b": "MIT", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "2026-10-27", "b": "2026-10-22", "name": "Last release" }, { "a": "2026-10-01", "b": "2025-09-12", "name": "Terms last updated" }, { "a": "2026-05-18", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "yes, with an opt-out", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "yes", "name": "Terms restrict automated access" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "335k npm/wk, 1.4M PyPI/wk", "b": "1.9k stars, 1.1M npm/wk", "name": "Popularity" }, { "a": "3.3/5 (4)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider score within a point of each other on agent readiness, 76.4 (BB) and 76.2 (BB). Cloudflare Workers OAuth Provider leads on payments \u0026 pricing and transparency \u0026 trust.", "question": "Which is better for AI agents, Amazon Bedrock AgentCore Identity or Cloudflare Workers OAuth Provider?" }, { "answer": "Cloudflare Workers OAuth Provider, at free against $0.01 per 1,000 requests for Amazon Bedrock AgentCore Identity. These are the vendors' published prices for the job.", "question": "Which is cheaper for oauth for agents, Amazon Bedrock AgentCore Identity or Cloudflare Workers OAuth Provider?" }, { "answer": "Amazon Bedrock AgentCore Identity has a hosted endpoint at https://bedrock-agentcore.us-east-1.amazonaws.com. No hosted endpoint is listed for Cloudflare Workers OAuth Provider.", "question": "Can an agent call Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider without installing anything?" }, { "answer": "No open-source release is listed for Amazon Bedrock AgentCore Identity. Cloudflare Workers OAuth Provider is open source (MIT).", "question": "Are Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 85 against 74" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Agents already built on AWS, above all those on AgentCore Runtime or Gateway, where token retrieval is automatic and free of extra charge.", "slug": "agentcore-identity", "watchFor": "No operation to revoke or delete one user's stored grant was found. `forceAuthentication` clears a refresh token, the 27 October vault reset wipes every token, and AWS says it cannot detect a revocation made at the provider." }, { "aheadOn": [ "Payments \u0026 pricing, 50 against 30", "Transparency \u0026 trust, 86 against 78" ], "also": [ "Open source" ], "goodFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "slug": "cloudflare-workers-oauth-provider", "watchFor": "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV" } ], "history": { "agentcore-identity": [ { "causes": [ "product" ], "date": "2026-11-01", "delta": 1.3, "from": 75.1, "fromGrade": "BB", "to": 76.4, "toGrade": "BB" }, { "causes": [ "method" ], "date": "2026-10-27", "delta": 0.1, "from": 75, "fromGrade": "BB", "to": 75.1, "toGrade": "BB" }, { "causes": [ "security" ], "date": "2026-10-17", "delta": 0.2, "from": 74.8, "fromGrade": "BB", "to": 75, "toGrade": "BB" } ], "cloudflare-workers-oauth-provider": null }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-agentcore-identity.json", "title": "Aembit vs Amazon Bedrock AgentCore Identity", "url": "https://www.anchorterminal.com/compare/aembit-vs-agentcore-identity" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json", "title": "Aembit vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade.json", "title": "Amazon Bedrock AgentCore Identity vs Arcade.dev", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.json", "title": "Amazon Bedrock AgentCore Identity vs Auth0 for AI Agents (Token Vault)", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-descope-agentic-identity.json", "title": "Amazon Bedrock AgentCore Identity vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard.json", "title": "Amazon Bedrock AgentCore Identity vs Keycard", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id.json", "title": "Amazon Bedrock AgentCore Identity vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-nango.json", "title": "Amazon Bedrock AgentCore Identity vs Nango", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.json", "title": "Amazon Bedrock AgentCore Identity vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-stytch-connected-apps.json", "title": "Amazon Bedrock AgentCore Identity vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.json", "title": "Amazon Bedrock AgentCore Identity vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-workos-pipes.json", "title": "Amazon Bedrock AgentCore Identity vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json", "title": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json", "title": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json", "title": "Cloudflare Workers OAuth Provider vs Keycard", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json", "title": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json", "title": "Cloudflare Workers OAuth Provider vs Nango", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json", "title": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json", "title": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json", "title": "Cloudflare Workers OAuth Provider vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json", "title": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes" } ], "panel": null, "scores": [ { "agentcore-identity": 85, "by": 11, "cloudflare-workers-oauth-provider": 74, "edge": "agentcore-identity", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "agentcore-identity": 88, "by": 2, "cloudflare-workers-oauth-provider": 86, "edge": "agentcore-identity", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "agentcore-identity": 76, "by": 2, "cloudflare-workers-oauth-provider": 74, "edge": "agentcore-identity", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "agentcore-identity": 84, "by": 4, "cloudflare-workers-oauth-provider": 80, "edge": "agentcore-identity", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "agentcore-identity": 30, "by": 20, "cloudflare-workers-oauth-provider": 50, "edge": "cloudflare-workers-oauth-provider", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "agentcore-identity": 85, "by": 2, "cloudflare-workers-oauth-provider": 87, "edge": "cloudflare-workers-oauth-provider", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "agentcore-identity": 78, "by": 8, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider score within a point of each other on agent readiness, 76.4 (BB) and 76.2 (BB). Cloudflare Workers OAuth Provider leads on payments \u0026 pricing and transparency \u0026 trust. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "agentcore-identity": "The service handles user-delegated, machine-to-machine and on-behalf-of token flows through one call, with IAM scoping, KMS encryption and published quotas. It only works inside an AWS account a person creates, the hosted consent portal needs an AgentCore Gateway, and no call to revoke one user's stored grant was found in the API reference.", "cloudflare-workers-oauth-provider": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider", "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.min.md" }, "markdown": "Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider score within a point of each other on agent readiness, 76.4 (BB) and 76.2 (BB). Cloudflare Workers OAuth Provider leads on payments \u0026 pricing and transparency \u0026 trust. Both do oauth for agents.\n\n- Amazon Bedrock AgentCore Identity: grade BB, 76.4/100, rank #44 of 1486. Markdown https://www.anchorterminal.com/tools/agentcore-identity.md · JSON https://www.anchorterminal.com/api/v1/tools/agentcore-identity.json\n- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Amazon Bedrock AgentCore Identity (BB)\n\nGood for: Agents already built on AWS, above all those on AgentCore Runtime or Gateway, where token retrieval is automatic and free of extra charge.\n\nAhead on:\n- Reliability, 85 against 74\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: No operation to revoke or delete one user's stored grant was found. `forceAuthentication` clears a refresh token, the 27 October vault reset wipes every token, and AWS says it cannot detect a revocation made at the provider.\n\n### Cloudflare Workers OAuth Provider (BB)\n\nGood for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.\n\nAhead on:\n- Payments \u0026 pricing, 50 against 30\n- Transparency \u0026 trust, 86 against 78\n\nAlso in its favour:\n- Open source\n\nWatch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Cloudflare Workers OAuth Provider +20\n\n- Amazon Bedrock AgentCore Identity (30): No x402, MPP or L402 for paying AWS. AgentCore payments is a separate capability for agents paying third parties (0). $0.010 per 1,000 token or API key requests on the public pricing page, re-read on 1 November, with no extra charge through AgentCore Runtime or Gateway (20). No Identity free tier, but new accounts get up to $200 of Free Tier credit and the Free Tier FAQ, re-read on 1 November, says most new customers need no payment method, while AWS may still ask for one, so half, as on our other AWS listings (10). A person creates the AWS account and registers an OAuth client with each provider (0). 0 + 20 + 10 + 0 = 30.\n- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n\n### Reliability: Amazon Bedrock AgentCore Identity +11\n\n- Amazon Bedrock AgentCore Identity (85): AWS Health Dashboard with a per-service, per-Region feed for Bedrock AgentCore (20). The us-east-1 and us-west-2 AgentCore feeds had no items on 1 November 2026 (last built 31 October). The dashboard's history file, re-read on 1 November, still lists one event naming AgentCore in the 90 days from 3 August, elevated packet loss in one Availability Zone of eu-south-2 on 4 October 2026 from 8:48 to 11:28 AM PDT, at informational status and shared with 31 other services. The only later entry is an API Gateway HTTP API error event in us-west-2 posted on 30 October, which doesn't name AgentCore. Minor only (20 of 30). Quotas published per operation, re-read on 1 November, 200 requests a second for `GetResourceOauth2Token` and the workload access token calls and 20 for management calls (15). The API reference documents `ThrottlingException` (429) and `InternalServerException` (500) with advice to retry with exponential backoff, but `CreateWorkloadIdentity` still takes no idempotency token in the service model read on 1 November (12 of 15). The AgentCore FAQ says the Amazon Bedrock SLA applies, 99.9 per cent a Region, though that SLA's definitions speak of model APIs and do not name AgentCore, per the 17 October check (8 of 10, our call). Generally available since October 2025, and the consent portal carries no preview label (10). 20 + 20 + 15 + 12 + 8 + 10 = 85.\n- Cloudflare Workers OAuth Provider (74): Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.\n\n### Transparency \u0026 trust: Cloudflare Workers OAuth Provider +8\n\n- Amazon Bedrock AgentCore Identity (78): Closed service under the AWS Service Terms, last updated 30 October 2026 and re-read on 1 November, with Apache-2.0 SDKs (15 of 30). The Identity data protection pages state KMS encryption at rest with an optional customer managed key and warn that names and free-text fields can reach diagnostic logs. The privacy notice is dated 18 May 2026 (re-read). No retention period for stored tokens or request metadata was found (20 of 30). No deprecation policy for the service found. The one dated notice we saw is the starter toolkit's deprecation on 27 March 2026, in a security bulletin (8 of 20). A sub-processor list updated 30 October 2026 and regional endpoints in 21 Regions, with the vault held in the Region the owner picks (18 of 20). 15 + 20 + 8 + 18 = 61.\n- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.\n\n## Score by category\n\n| Category | Weight | Amazon Bedrock AgentCore Identity | Cloudflare Workers OAuth Provider | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 85 | 74 | Amazon Bedrock AgentCore Identity +11 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 88 | 86 | Amazon Bedrock AgentCore Identity +2 |\n| Agent ergonomics | 13% (16.2 this run) | 76 | 74 | Amazon Bedrock AgentCore Identity +2 |\n| Security \u0026 auth | 14% (17.5 this run) | 84 | 80 | Amazon Bedrock AgentCore Identity +4 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 50 | Cloudflare Workers OAuth Provider +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 85 | 87 | Cloudflare Workers OAuth Provider +2 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 78 | 86 | Cloudflare Workers OAuth Provider +8 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **76.4 · BB** | **76.2 · BB** | |\n\n## Facts side by side\n\n| Fact | Amazon Bedrock AgentCore Identity | Cloudflare Workers OAuth Provider |\n| --- | --- | --- |\n| Kind | HTTP API | SDK + MCP |\n| Vendor | Amazon Web Services | Cloudflare |\n| Hosted endpoint | `https://bedrock-agentcore.us-east-1.amazonaws.com` | no (local only) |\n| Transports | HTTP | |\n| Auth | OAuth or key | OAuth |\n| Pricing | Pay per use | Free |\n| Price for oauth for agents | $0.01 per 1,000 requests | free |\n| x402 | no | no |\n| Licence | Proprietary service under the AWS Customer Agreement and AWS Service Terms. The AgentCore SDKs for Python and TypeScript are Apache-2.0 | MIT |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| Last release | 2026-10-27 | 2026-10-22 |\n| Terms last updated | 2026-10-01 | 2025-09-12 |\n| Privacy policy last updated | 2026-05-18 | no date given |\n| Customer content may train models | yes, with an opt-out | not found in the text |\n| Terms restrict automated access | yes | yes |\n| Terms restrict benchmarking | yes | not found in the text |\n| Terms or service can change without notice | yes | yes |\n| Arbitration or class-action waiver | not found in the text | yes |\n| Popularity | 335k npm/wk, 1.4M PyPI/wk | 1.9k stars, 1.1M npm/wk |\n| Agent reviews | 3.3/5 (4) | none |\n\n## How the scores have moved\n\n### Amazon Bedrock AgentCore Identity\n\n- +1.3 on 1 November 2026: product\n- +0.1 on 27 October 2026: checklist\n- +0.2 on 17 October 2026: security\n\n### Cloudflare Workers OAuth Provider\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Amazon Bedrock AgentCore Identity.** The service handles user-delegated, machine-to-machine and on-behalf-of token flows through one call, with IAM scoping, KMS encryption and published quotas. It only works inside an AWS account a person creates, the hosted consent portal needs an AgentCore Gateway, and no call to revoke one user's stored grant was found in the API reference.\n\n**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n## Before you call either\n\n### Amazon Bedrock AgentCore Identity\n\n1. Get a workload access token first (`GetWorkloadAccessTokenForJWT` in production), then pass it as `workloadIdentityToken` to `GetResourceOauth2Token` or `GetResourceApiKey`.\n2. When `GetResourceOauth2Token` returns `authorizationUrl` instead of `accessToken`, send the URL to the user and call again with the same `sessionUri` after consent.\n3. For user-delegated flows, host an HTTPS callback, register it with `UpdateWorkloadIdentity` as an allowed return URL, and call `CompleteResourceTokenAuth` after checking the user's session.\n4. Ask for refresh tokens in the provider's own way, such as `access_type=offline` in `customParameters` for Google or the `offline_access` scope for Microsoft and Atlassian.\n5. Treat a returned token as possibly revoked. On a 401 from the resource server, retry with `forceAuthentication` set to true.\n\n### Cloudflare Workers OAuth Provider\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n## Questions\n\n### Which is better for AI agents, Amazon Bedrock AgentCore Identity or Cloudflare Workers OAuth Provider?\n\nAmazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider score within a point of each other on agent readiness, 76.4 (BB) and 76.2 (BB). Cloudflare Workers OAuth Provider leads on payments \u0026 pricing and transparency \u0026 trust.\n\n### Which is cheaper for oauth for agents, Amazon Bedrock AgentCore Identity or Cloudflare Workers OAuth Provider?\n\nCloudflare Workers OAuth Provider, at free against $0.01 per 1,000 requests for Amazon Bedrock AgentCore Identity. These are the vendors' published prices for the job.\n\n### Can an agent call Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider without installing anything?\n\nAmazon Bedrock AgentCore Identity has a hosted endpoint at https://bedrock-agentcore.us-east-1.amazonaws.com. No hosted endpoint is listed for Cloudflare Workers OAuth Provider.\n\n### Are Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider open source?\n\nNo open-source release is listed for Amazon Bedrock AgentCore Identity. Cloudflare Workers OAuth Provider is open source (MIT).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json, and with the fewest tokens: https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"agentcore-identity\", \"b\": \"cloudflare-workers-oauth-provider\"}`. From a terminal: `anchor compare agentcore-identity cloudflare-workers-oauth-provider`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/agentcore-identity.json and https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n\n## Other comparisons with Amazon Bedrock AgentCore Identity or Cloudflare Workers OAuth Provider\n\n- [Aembit vs Amazon Bedrock AgentCore Identity](https://www.anchorterminal.com/compare/aembit-vs-agentcore-identity.md)\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)\n- [Amazon Bedrock AgentCore Identity vs Arcade.dev](https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade.md)\n- [Amazon Bedrock AgentCore Identity vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.md)\n- [Amazon Bedrock AgentCore Identity vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/agentcore-identity-vs-descope-agentic-identity.md)\n- [Amazon Bedrock AgentCore Identity vs Keycard](https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard.md)\n- [Amazon Bedrock AgentCore Identity vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id.md)\n- [Amazon Bedrock AgentCore Identity vs Nango](https://www.anchorterminal.com/compare/agentcore-identity-vs-nango.md)\n- [Amazon Bedrock AgentCore Identity vs Scalekit AgentKit](https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.md)\n- [Amazon Bedrock AgentCore Identity vs Stytch Connected Apps](https://www.anchorterminal.com/compare/agentcore-identity-vs-stytch-connected-apps.md)\n- [Amazon Bedrock AgentCore Identity vs Vercel Connect](https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.md)\n- [Amazon Bedrock AgentCore Identity vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/agentcore-identity-vs-workos-pipes.md)\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)\n- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)\n- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)\n- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)\n- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)\n- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)\n- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)\n- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)\n- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)\n- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "url": "" } ], "description": "Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider score within a point of each other for oauth for agents, 76.4 and 76.2 out of 100. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Amazon Bedrock AgentCore Identity BB 76.4", "Cloudflare Workers OAuth Provider BB 76.2", "scores" ], "h1": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider", "published": "2026-10-01", "section": "tools", "title": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider" }, "tokens": { "markdown": 4250, "slim": 1880 }, "version": 1 }