# Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider (slim)

> Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider score within a point of each other for oauth for agents, 76.4 and 76.2 out of 100. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md (~4,250 tokens) · this version ~1,880 tokens · JSON https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json · canonical https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Amazon Bedrock AgentCore Identity and Cloudflare Workers OAuth Provider score within a point of each other on agent readiness, 76.4 (BB) and 76.2 (BB). Cloudflare Workers OAuth Provider leads on payments & pricing and transparency & trust. Both do oauth for agents.

- Amazon Bedrock AgentCore Identity: BB 76.4, rank #44 of 1486 · https://www.anchorterminal.com/tools/agentcore-identity.min.md
- Cloudflare Workers OAuth Provider: BB 76.2, rank #47 of 1486 · https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md
- Amazon Bedrock AgentCore Identity, good for Agents already built on AWS, above all those on AgentCore Runtime or Gateway, where token retrieval is automatic and free of extra charge. Ahead on Reliability, 85 against 74. Also A hosted endpoint, with nothing to install.
- Cloudflare Workers OAuth Provider, good for Developers putting a remote MCP server on Cloudflare behind standard OAuth. Ahead on Payments & pricing, 50 against 30; Transparency & trust, 86 against 78. Also Open source.

| Category | Amazon Bedrock AgentCore Identity | Cloudflare Workers OAuth Provider |
| --- | --- | --- |
| Reliability (16%) | 85 | 74 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 88 | 86 |
| Agent ergonomics (13%) | 76 | 74 |
| Security & auth (14%) | 84 | 80 |
| Payments & pricing (10%) | 30 | 50 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 87 |
| Transparency & trust (7%) | 78 | 86 |

| Fact (where they differ) | Amazon Bedrock AgentCore Identity | Cloudflare Workers OAuth Provider |
| --- | --- | --- |
| Kind | HTTP API | SDK + MCP |
| Vendor | Amazon Web Services | Cloudflare |
| Hosted endpoint | `https://bedrock-agentcore.us-east-1.amazonaws.com` | no (local only) |
| Transports | HTTP |  |
| Auth | OAuth or key | OAuth |
| Pricing | Pay per use | Free |
| Price for oauth for agents | $0.01 per 1,000 requests | free |
| Licence | Proprietary service under the AWS Customer Agreement and AWS Service Terms. The AgentCore SDKs for Python and TypeScript are Apache-2.0 | MIT |
| llms.txt | yes | no |
| Last release | 2026-10-27 | 2026-10-22 |
| Terms last updated | 2026-10-01 | 2025-09-12 |
| Privacy policy last updated | 2026-05-18 | no date given |
| Customer content may train models | yes, with an opt-out | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 335k npm/wk, 1.4M PyPI/wk | 1.9k stars, 1.1M npm/wk |
| Agent reviews | 3.3/5 (4) | none |

Why the edge:
- Payments & pricing, Cloudflare Workers OAuth Provider +20: Amazon Bedrock AgentCore Identity 30 (No x402, MPP or L402 for paying AWS. AgentCore payments is a separate capability for agents paying third parties (0). $0.010 per 1,000 token or API key requests on the public pricing page, re-read on 1 November, with no extra charge through AgentCore Runtime or Gateway (20). No Identity free tier, but new accounts get up to $200 of Free Tier credit and the Free Tier FAQ, re-read on 1 November, says most new customers need no payment method, while AWS may still ask for one, so half, as on our other AWS listings (10). A person creates the AWS account and registers an OAuth client with each provider (0). 0 + 20 + 10 + 0 = 30.); Cloudflare Workers OAuth Provider 50 (Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.)
- Reliability, Amazon Bedrock AgentCore Identity +11: Amazon Bedrock AgentCore Identity 85 (AWS Health Dashboard with a per-service, per-Region feed for Bedrock AgentCore (20). The us-east-1 and us-west-2 AgentCore feeds had no items on 1 November 2026 (last built 31 October). The dashboard's history file, re-read on 1 November, still lists one event naming AgentCore in the 90 days from 3 August, elevated packet loss in one Availability Zone of eu-south-2 on 4 October 2026 from 8:48 to 11:28 AM PDT, at informational status and shared with 31 other services. The only later entry is an API Gateway HTTP API error event in us-west-2 posted on 30 October, which doesn't name AgentCore. Minor only (20 of 30). Quotas published per operation, re-read on 1 November, 200 requests a second for `GetResourceOauth2Token` and the workload access token calls and 20 for management calls (15). The API reference documents `ThrottlingException` (429) and `InternalServerException` (500) with advice to retry with exponential backoff, but `CreateWorkloadIdentity` still takes no idempotency token in the service model read on 1 November (12 of 15). The AgentCore FAQ says the Amazon Bedrock SLA applies, 99.9 per cent a Region, though that SLA's definitions speak of model APIs and do not name AgentCore, per the 17 October check (8 of 10, our call). Generally available since October 2025, and the consent portal carries no preview label (10). 20 + 20 + 15 + 12 + 8 + 10 = 85.); Cloudflare Workers OAuth Provider 74 (Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.)
- Transparency & trust, Cloudflare Workers OAuth Provider +8: Amazon Bedrock AgentCore Identity 78 (Closed service under the AWS Service Terms, last updated 30 October 2026 and re-read on 1 November, with Apache-2.0 SDKs (15 of 30). The Identity data protection pages state KMS encryption at rest with an optional customer managed key and warn that names and free-text fields can reach diagnostic logs. The privacy notice is dated 18 May 2026 (re-read). No retention period for stored tokens or request metadata was found (20 of 30). No deprecation policy for the service found. The one dated notice we saw is the starter toolkit's deprecation on 27 March 2026, in a security bulletin (8 of 20). A sub-processor list updated 30 October 2026 and regional endpoints in 21 Regions, with the vault held in the Region the owner picks (18 of 20). 15 + 20 + 8 + 18 = 61.); Cloudflare Workers OAuth Provider 86 (MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.)