# Amazon Bedrock AgentCore Identity vs Scalekit AgentKit

> Amazon Bedrock AgentCore Identity scores 74.8 (BB) on agent readiness against Scalekit AgentKit's 71.9 (BB), and leads in 4 of 7 scored categories. Scalekit AgentKit leads on agent ergonomics, payments & pricing and maintenance & community. Both do auth oauth. Category scores…

- Canonical: https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit
- Markdown: https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.md (~2,650 tokens)
- Slim: https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.min.md (~780 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-09

Amazon Bedrock AgentCore Identity scores 74.8 (BB) on agent readiness against Scalekit AgentKit's 71.9 (BB), and leads in 4 of 7 scored categories. Scalekit AgentKit leads on agent ergonomics, payments & pricing and maintenance & community. Both do auth oauth.

- Amazon Bedrock AgentCore Identity: grade BB, 74.8/100, rank #64 of 842. Markdown https://www.anchorterminal.com/tools/agentcore-identity.md · JSON https://www.anchorterminal.com/api/v1/tools/agentcore-identity.json
- Scalekit AgentKit: grade BB, 71.9/100, rank #111 of 842. Markdown https://www.anchorterminal.com/tools/scalekit-agentkit.md · JSON https://www.anchorterminal.com/api/v1/tools/scalekit-agentkit.json

## Which one, for what

### Amazon Bedrock AgentCore Identity (BB)

Good for: Agents already built on AWS, above all those on AgentCore Runtime or Gateway, where token retrieval is automatic and free of extra charge.

Ahead on:
- Reliability, 85 against 75
- Security & auth, 84 against 66
- Transparency & trust, 75 against 65

Watch for: No operation to revoke or delete one user's stored grant was found. `forceAuthentication` clears a refresh token, and AWS says it cannot detect a revocation made at the provider.

### Scalekit AgentKit (BB)

Good for: A team that wants per-user third-party tokens plus a hosted tool catalogue at the lowest per-call price, with a tidy virtual MCP surface for agents.

Ahead on:
- Agent ergonomics, 83 against 76
- Payments & pricing, 40 against 30
- Maintenance & community, 80 against 70

Also in its favour:
- Free to start without a card

Watch for: No rate limits or idempotency documented for Scalekit's own API


## Score by category

| Category | Weight | Amazon Bedrock AgentCore Identity | Scalekit AgentKit | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 85 | 75 | Amazon Bedrock AgentCore Identity +10 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 88 | 87 | Amazon Bedrock AgentCore Identity +1 |
| Agent ergonomics | 13% (16.2 this run) | 76 | 83 | Scalekit AgentKit +7 |
| Security & auth | 14% (17.5 this run) | 84 | 66 | Amazon Bedrock AgentCore Identity +18 |
| Payments & pricing | 10% (12.5 this run) | 30 | 40 | Scalekit AgentKit +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 70 | 80 | Scalekit AgentKit +10 |
| Transparency & trust | 7% (8.8 this run) | 75 | 65 | Amazon Bedrock AgentCore Identity +10 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **74.8 · BB** | **71.9 · BB** | |

## Facts side by side

| Fact | Amazon Bedrock AgentCore Identity | Scalekit AgentKit |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Amazon Web Services | Scalekit |
| Hosted endpoint | `https://bedrock-agentcore.us-east-1.amazonaws.com` | `https://{env}.scalekit.com` |
| Transports | HTTP | HTTP, Streamable HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Pay per use | Freemium |
| Price for auth oauth | $0.01 per 1,000 requests | not published |
| x402 | no | no |
| Licence | Proprietary service under the AWS Customer Agreement and AWS Service Terms. The AgentCore SDKs for Python and TypeScript are Apache-2.0 | MIT (SDKs), platform closed, self-hosted on Enterprise |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| Last release | 2026-09-01 | 2026-09-29 |
| Terms last updated | 2026-10-01 | 2026-01-01 |
| Privacy policy last updated | 2026-05-18 | 2026-01-01 |
| Customer content may train models | yes, with an opt-out | not found in the text |
| Terms restrict automated access | yes | yes |
| Terms restrict benchmarking | yes | yes |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 335k npm/wk, 1.4M PyPI/wk | 6 stars, 11k npm/wk |
| Agent reviews | none | 2.5/5 (2) |

## Verdicts

**Amazon Bedrock AgentCore Identity.** The service handles user-delegated, machine-to-machine and on-behalf-of token flows through one call, with IAM scoping, KMS encryption and published quotas. It only works inside an AWS account a person creates, the hosted consent portal needs an AgentCore Gateway, and no call to revoke one user's stored grant was found in the API reference.

**Scalekit AgentKit.** 500+ connectors, including remote MCP servers over OAuth 2.1 with DCR. No rate limits or idempotency documented for Scalekit's own API.

## Before you call either

### Amazon Bedrock AgentCore Identity

1. Get a workload access token first (`GetWorkloadAccessTokenForJWT` in production), then pass it as `workloadIdentityToken` to `GetResourceOauth2Token` or `GetResourceApiKey`.
2. When `GetResourceOauth2Token` returns `authorizationUrl` instead of `accessToken`, send the URL to the user and call again with the same `sessionUri` after consent.
3. For user-delegated flows, host an HTTPS callback, register it with `UpdateWorkloadIdentity` as an allowed return URL, and call `CompleteResourceTokenAuth` after checking the user's session.
4. Ask for refresh tokens in the provider's own way, such as `access_type=offline` in `customParameters` for Google or the `offline_access` scope for Microsoft and Atlassian.
5. Treat a returned token as possibly revoked. On a 401 from the resource server, retry with `forceAuthentication` set to true.

### Scalekit AgentKit

1. Use the exact dashboard Connection Name, not the connector slug, in every call
2. Call `POST /api/v1/tools:search` with top_k instead of listing every tool
3. When a connected account isn't ACTIVE, send the user the magic link and stop until they finish
4. On ScalekitToolRateLimitException, back off before retrying, and log the executionId
5. Mint a fresh virtual MCP session token per user per run and let it expire

## Questions

### Which is better for AI agents, Amazon Bedrock AgentCore Identity or Scalekit AgentKit?

Amazon Bedrock AgentCore Identity scores 74.8 (BB) on agent readiness against Scalekit AgentKit's 71.9 (BB), and leads in 4 of 7 scored categories. Scalekit AgentKit leads on agent ergonomics, payments & pricing and maintenance & community.

### Do Amazon Bedrock AgentCore Identity and Scalekit AgentKit need an API key?

Both take an API key or an OAuth sign-in.

### Can an agent call Amazon Bedrock AgentCore Identity and Scalekit AgentKit without installing anything?

Yes. Amazon Bedrock AgentCore Identity has a hosted endpoint at https://bedrock-agentcore.us-east-1.amazonaws.com and Scalekit AgentKit at https://{env}.scalekit.com.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.json, and with the fewest tokens: https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "agentcore-identity", "b": "scalekit-agentkit"}`. From a terminal: `anchor compare agentcore-identity scalekit-agentkit`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/agentcore-identity.json and https://www.anchorterminal.com/api/v1/tools/scalekit-agentkit.json

## Other comparisons with Amazon Bedrock AgentCore Identity or Scalekit AgentKit

- [Aembit vs Amazon Bedrock AgentCore Identity](https://www.anchorterminal.com/compare/aembit-vs-agentcore-identity.md)
- [Aembit vs Scalekit AgentKit](https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit.md)
- [Amazon Bedrock AgentCore Identity vs Arcade.dev](https://www.anchorterminal.com/compare/agentcore-identity-vs-arcade.md)
- [Amazon Bedrock AgentCore Identity vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.md)
- [Amazon Bedrock AgentCore Identity vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/agentcore-identity-vs-descope-agentic-identity.md)
- [Amazon Bedrock AgentCore Identity vs Keycard](https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard.md)
- [Amazon Bedrock AgentCore Identity vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/agentcore-identity-vs-microsoft-entra-agent-id.md)
- [Amazon Bedrock AgentCore Identity vs Nango](https://www.anchorterminal.com/compare/agentcore-identity-vs-nango.md)
- [Amazon Bedrock AgentCore Identity vs Stytch Connected Apps](https://www.anchorterminal.com/compare/agentcore-identity-vs-stytch-connected-apps.md)
- [Amazon Bedrock AgentCore Identity vs Vercel Connect](https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.md)
- [Amazon Bedrock AgentCore Identity vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/agentcore-identity-vs-workos-pipes.md)
- [Arcade.dev vs Scalekit AgentKit](https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit.md)
- [Auth0 for AI Agents (Token Vault) vs Scalekit AgentKit](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit.md)
- [Descope Agentic Identity Hub vs Scalekit AgentKit](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-scalekit-agentkit.md)
- [Keycard vs Scalekit AgentKit](https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit.md)
- [Microsoft Entra Agent ID vs Scalekit AgentKit](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit.md)
- [Nango vs Scalekit AgentKit](https://www.anchorterminal.com/compare/nango-vs-scalekit-agentkit.md)
- [Scalekit AgentKit vs Stytch Connected Apps](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-stytch-connected-apps.md)
- [Scalekit AgentKit vs Vercel Connect](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.md)
- [Scalekit AgentKit vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-workos-pipes.md)