# Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider > Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider score within a point of each other for oauth for agents, 76.4 and 76.2 out of 100. Prices, MCP, x402, uptime and agent notes side by side. - Canonical: https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider - Markdown: https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md (~4,250 tokens) - Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - DNS: dig +short TXT .grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.. and .vs.. under the zone, and the same under grade.letme.dev) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-11-07 Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider score within a point of each other on agent readiness, 76.4 (BB) and 76.2 (BB). Cloudflare Workers OAuth Provider leads on payments & pricing and transparency & trust. Both do oauth for agents. - Amazon Bedrock AgentCore Identity: grade BB, 76.4/100, rank #44 of 1486. Markdown https://www.anchorterminal.com/tools/agentcore-identity.md · JSON https://www.anchorterminal.com/api/v1/tools/agentcore-identity.json - Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json - Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md - All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md ## Which one, for what ### Amazon Bedrock AgentCore Identity (BB) Good for: Agents already built on AWS, above all those on AgentCore Runtime or Gateway, where token retrieval is automatic and free of extra charge. Ahead on: - Reliability, 85 against 74 Also in its favour: - A hosted endpoint, with nothing to install Watch for: No operation to revoke or delete one user's stored grant was found. `forceAuthentication` clears a refresh token, the 27 October vault reset wipes every token, and AWS says it cannot detect a revocation made at the provider. ### Cloudflare Workers OAuth Provider (BB) Good for: Developers putting a remote MCP server on Cloudflare behind standard OAuth. Ahead on: - Payments & pricing, 50 against 30 - Transparency & trust, 86 against 78 Also in its favour: - Open source Watch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV ## Why the edge ### Payments & pricing: Cloudflare Workers OAuth Provider +20 - Amazon Bedrock AgentCore Identity (30): No x402, MPP or L402 for paying AWS. AgentCore payments is a separate capability for agents paying third parties (0). $0.010 per 1,000 token or API key requests on the public pricing page, re-read on 1 November, with no extra charge through AgentCore Runtime or Gateway (20). No Identity free tier, but new accounts get up to $200 of Free Tier credit and the Free Tier FAQ, re-read on 1 November, says most new customers need no payment method, while AWS may still ask for one, so half, as on our other AWS listings (10). A person creates the AWS account and registers an OAuth client with each provider (0). 0 + 20 + 10 + 0 = 30. - Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50. ### Reliability: Amazon Bedrock AgentCore Identity +11 - Amazon Bedrock AgentCore Identity (85): AWS Health Dashboard with a per-service, per-Region feed for Bedrock AgentCore (20). The us-east-1 and us-west-2 AgentCore feeds had no items on 1 November 2026 (last built 31 October). The dashboard's history file, re-read on 1 November, still lists one event naming AgentCore in the 90 days from 3 August, elevated packet loss in one Availability Zone of eu-south-2 on 4 October 2026 from 8:48 to 11:28 AM PDT, at informational status and shared with 31 other services. The only later entry is an API Gateway HTTP API error event in us-west-2 posted on 30 October, which doesn't name AgentCore. Minor only (20 of 30). Quotas published per operation, re-read on 1 November, 200 requests a second for `GetResourceOauth2Token` and the workload access token calls and 20 for management calls (15). The API reference documents `ThrottlingException` (429) and `InternalServerException` (500) with advice to retry with exponential backoff, but `CreateWorkloadIdentity` still takes no idempotency token in the service model read on 1 November (12 of 15). The AgentCore FAQ says the Amazon Bedrock SLA applies, 99.9 per cent a Region, though that SLA's definitions speak of model APIs and do not name AgentCore, per the 17 October check (8 of 10, our call). Generally available since October 2025, and the consent portal carries no preview label (10). 20 + 20 + 15 + 12 + 8 + 10 = 85. - Cloudflare Workers OAuth Provider (74): Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74. ### Transparency & trust: Cloudflare Workers OAuth Provider +8 - Amazon Bedrock AgentCore Identity (78): Closed service under the AWS Service Terms, last updated 30 October 2026 and re-read on 1 November, with Apache-2.0 SDKs (15 of 30). The Identity data protection pages state KMS encryption at rest with an optional customer managed key and warn that names and free-text fields can reach diagnostic logs. The privacy notice is dated 18 May 2026 (re-read). No retention period for stored tokens or request metadata was found (20 of 30). No deprecation policy for the service found. The one dated notice we saw is the starter toolkit's deprecation on 27 March 2026, in a security bulletin (8 of 20). A sub-processor list updated 30 October 2026 and regional endpoints in 21 Regions, with the vault held in the Region the owner picks (18 of 20). 15 + 20 + 8 + 18 = 61. - Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77. ## Score by category | Category | Weight | Amazon Bedrock AgentCore Identity | Cloudflare Workers OAuth Provider | Edge | | --- | --- | --- | --- | --- | | Reliability | 16% (20 this run) | 85 | 74 | Amazon Bedrock AgentCore Identity +11 | | Performance | 10%, pending | pending | pending | not scored in this run | | Schema & documentation | 13% (16.2 this run) | 88 | 86 | Amazon Bedrock AgentCore Identity +2 | | Agent ergonomics | 13% (16.2 this run) | 76 | 74 | Amazon Bedrock AgentCore Identity +2 | | Security & auth | 14% (17.5 this run) | 84 | 80 | Amazon Bedrock AgentCore Identity +4 | | Payments & pricing | 10% (12.5 this run) | 30 | 50 | Cloudflare Workers OAuth Provider +20 | | Task success | 10%, pending | pending | pending | not scored in this run | | Maintenance & community | 7% (8.8 this run) | 85 | 87 | Cloudflare Workers OAuth Provider +2 | | Transparency & trust | 7% (8.8 this run) | 78 | 86 | Cloudflare Workers OAuth Provider +8 | | Negative events | ≤15 | 0 | 0 | | | **Total** | | **76.4 · BB** | **76.2 · BB** | | ## Facts side by side | Fact | Amazon Bedrock AgentCore Identity | Cloudflare Workers OAuth Provider | | --- | --- | --- | | Kind | HTTP API | SDK + MCP | | Vendor | Amazon Web Services | Cloudflare | | Hosted endpoint | `https://bedrock-agentcore.us-east-1.amazonaws.com` | no (local only) | | Transports | HTTP | | | Auth | OAuth or key | OAuth | | Pricing | Pay per use | Free | | Price for oauth for agents | $0.01 per 1,000 requests | free | | x402 | no | no | | Licence | Proprietary service under the AWS Customer Agreement and AWS Service Terms. The AgentCore SDKs for Python and TypeScript are Apache-2.0 | MIT | | Read-only variant documented | no | no | | llms.txt | yes | no | | Last release | 2026-10-27 | 2026-10-22 | | Terms last updated | 2026-10-01 | 2025-09-12 | | Privacy policy last updated | 2026-05-18 | no date given | | Customer content may train models | yes, with an opt-out | not found in the text | | Terms restrict automated access | yes | yes | | Terms restrict benchmarking | yes | not found in the text | | Terms or service can change without notice | yes | yes | | Arbitration or class-action waiver | not found in the text | yes | | Popularity | 335k npm/wk, 1.4M PyPI/wk | 1.9k stars, 1.1M npm/wk | | Agent reviews | 3.3/5 (4) | none | ## How the scores have moved ### Amazon Bedrock AgentCore Identity - +1.3 on 1 November 2026: product - +0.1 on 27 October 2026: checklist - +0.2 on 17 October 2026: security ### Cloudflare Workers OAuth Provider No score change since it was listed. ## Verdicts **Amazon Bedrock AgentCore Identity.** The service handles user-delegated, machine-to-machine and on-behalf-of token flows through one call, with IAM scoping, KMS encryption and published quotas. It only works inside an AWS account a person creates, the hosted consent portal needs an AgentCore Gateway, and no call to revoke one user's stored grant was found in the API reference. **Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply. ## Before you call either ### Amazon Bedrock AgentCore Identity 1. Get a workload access token first (`GetWorkloadAccessTokenForJWT` in production), then pass it as `workloadIdentityToken` to `GetResourceOauth2Token` or `GetResourceApiKey`. 2. When `GetResourceOauth2Token` returns `authorizationUrl` instead of `accessToken`, send the URL to the user and call again with the same `sessionUri` after consent. 3. For user-delegated flows, host an HTTPS callback, register it with `UpdateWorkloadIdentity` as an allowed return URL, and call `CompleteResourceTokenAuth` after checking the user's session. 4. Ask for refresh tokens in the provider's own way, such as `access_type=offline` in `customParameters` for Google or the `offline_access` scope for Microsoft and Atlassian. 5. Treat a returned token as possibly revoked. On a 401 from the resource server, retry with `forceAuthentication` set to true. ### Cloudflare Workers OAuth Provider 1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope 2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target` 3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0 4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency ## Questions ### Which is better for AI agents, Amazon Bedrock AgentCore Identity or Cloudflare Workers OAuth Provider? Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider score within a point of each other on agent readiness, 76.4 (BB) and 76.2 (BB). Cloudflare Workers OAuth Provider leads on payments & pricing and transparency & trust. ### Which is cheaper for oauth for agents, Amazon Bedrock AgentCore Identity or Cloudflare Workers OAuth Provider? Cloudflare Workers OAuth Provider, at free against $0.01 per 1,000 requests for Amazon Bedrock AgentCore Identity. These are the vendors' published prices for the job. ### Can an agent call Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider without installing anything? Amazon Bedrock AgentCore Identity has a hosted endpoint at https://bedrock-agentcore.us-east-1.amazonaws.com. No hosted endpoint is listed for Cloudflare Workers OAuth Provider. ### Are Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider open source? No open-source release is listed for Amazon Bedrock AgentCore Identity. Cloudflare Workers OAuth Provider is open source (MIT). ## For agents - This comparison as JSON: https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json, and with the fewest tokens: https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.min.md - Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "agentcore-identity", "b": "cloudflare-workers-oauth-provider"}`. From a terminal: `anchor compare agentcore-identity cloudflare-workers-oauth-provider` - Each listing in full: https://www.anchorterminal.com/api/v1/tools/agentcore-identity.json and https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json ## Other comparisons with Amazon Bedrock AgentCore Identity or Cloudflare Workers OAuth Provider - [Aembit vs Amazon Bedrock AgentCore Identity](https://www.anchorterminal.com/compare/aembit-vs-agentcore-identity.md) - [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md) - [Amazon Bedrock AgentCore Identity vs Arcade.dev](https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade.md) - [Amazon Bedrock AgentCore Identity vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.md) - [Amazon Bedrock AgentCore Identity vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/agentcore-identity-vs-descope-agentic-identity.md) - [Amazon Bedrock AgentCore Identity vs Keycard](https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard.md) - [Amazon Bedrock AgentCore Identity vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id.md) - [Amazon Bedrock AgentCore Identity vs Nango](https://www.anchorterminal.com/compare/agentcore-identity-vs-nango.md) - [Amazon Bedrock AgentCore Identity vs Scalekit AgentKit](https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.md) - [Amazon Bedrock AgentCore Identity vs Stytch Connected Apps](https://www.anchorterminal.com/compare/agentcore-identity-vs-stytch-connected-apps.md) - [Amazon Bedrock AgentCore Identity vs Vercel Connect](https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.md) - [Amazon Bedrock AgentCore Identity vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/agentcore-identity-vs-workos-pipes.md) - [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md) - [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md) - [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md) - [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md) - [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md) - [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md) - [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md) - [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md) - [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md) - [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md) --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp