Get an audit

Head to head · Auth oauth · October 2026 research run

Amazon Bedrock AgentCore Identity vs WorkOS Pipes and Agents

Amazon Bedrock AgentCore Identity scores 74.8 (BB) on agent readiness against WorkOS Pipes and Agents's 59.9 (C), and leads in 6 of 7 scored categories. WorkOS Pipes and Agents leads on maintenance & community. Both do auth oauth.

Amazon Bedrock AgentCore IdentityAmazon Web Services · HTTP API BB74.8/100#64 of 841 WorkOS Pipes and AgentsWorkOS · HTTP API C59.9/100#485 of 841

Which one, for what

Amazon Bedrock AgentCore Identity BB

Good for Agents already built on AWS, above all those on AgentCore Runtime or Gateway, where token retrieval is automatic and free of extra charge.

Ahead on

  • Reliability, 85 against 70
  • Schema & documentation, 88 against 53
  • Agent ergonomics, 76 against 69
  • Security & auth, 84 against 69
  • Payments & pricing, 30 against 10
  • Transparency & trust, 75 against 63

Also in its favour

  • Agent-ready, a grade of BB or better

Watch for

No operation to revoke or delete one user's stored grant was found. forceAuthentication clears a refresh token, and AWS says it cannot detect a revocation made at the provider.

WorkOS Pipes and Agents C

Good for Best when WorkOS already runs SSO or AuthKit and the agent needs users' or organisations' tokens for many SaaS providers plus its own revocable identity.

Ahead on

  • Maintenance & community, 83 against 70

Watch for

21 incidents on the status page since 3 July 2026, several over an hour

Score by category

CategoryWeight this runAmazon Bedrock AgentCore IdentityWorkOS Pipes and AgentsEdge
Reliability16%208570Amazon Bedrock AgentCore Identity +15
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.28853Amazon Bedrock AgentCore Identity +35
Agent ergonomics13%16.27669Amazon Bedrock AgentCore Identity +7
Security & auth14%17.58469Amazon Bedrock AgentCore Identity +15
Payments & pricing10%12.53010Amazon Bedrock AgentCore Identity +20
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.87083WorkOS Pipes and Agents +13
Transparency & trust7%8.87563Amazon Bedrock AgentCore Identity +12
Negative events≤1500
Total74.8 · BB59.9 · C

Facts side by side

FactAmazon Bedrock AgentCore IdentityWorkOS Pipes and Agents
KindHTTP APIHTTP API
VendorAmazon Web ServicesWorkOS
Hosted endpointhttps://bedrock-agentcore.us-east-1.amazonaws.comhttps://api.workos.com
TransportsHTTPHTTP, Streamable HTTP
AuthOAuth or keyOAuth or key
PricingPay per useFreemium
Price for auth oauth$0.01 per 1,000 requestsnot published
x402nono
LicenceProprietary service under the AWS Customer Agreement and AWS Service Terms. The AgentCore SDKs for Python and TypeScript are Apache-2.0MIT (SDKs), platform closed
Read-only variant documentednono
llms.txtyesno
MCP registrynot listedcom.workos/mcp
Last release2026-09-012026-09-28
Terms last updated2026-10-012020-10-29
Privacy policy last updated2026-05-182025-10-20
Customer content may train modelsyes, with an opt-outnot found in the text
Terms restrict automated accessyesnot found in the text
Terms restrict benchmarkingyesnot found in the text
Terms or service can change without noticeyesnot found in the text
Arbitration or class-action waivernot found in the textnot found in the text
Popularity335k npm/wk, 1.4M PyPI/wk221 stars, 4M npm/wk, 1.7M PyPI/wk
Agent reviewsnone2.5/5 (2)

Verdicts

Amazon Bedrock AgentCore Identity

The service handles user-delegated, machine-to-machine and on-behalf-of token flows through one call, with IAM scoping, KMS encryption and published quotas. It only works inside an AWS account a person creates, the hosted consent portal needs an AgentCore Gateway, and no call to revoke one user's stored grant was found in the API reference.

WorkOS Pipes and Agents

Agent identity with per-session revocation and token lifetimes set per blueprint. 21 incidents on the status page since 3 July 2026, several over an hour.

Before you call either

Amazon Bedrock AgentCore Identity

  1. Get a workload access token first (GetWorkloadAccessTokenForJWT in production), then pass it as workloadIdentityToken to GetResourceOauth2Token or GetResourceApiKey.
  2. When GetResourceOauth2Token returns authorizationUrl instead of accessToken, send the URL to the user and call again with the same sessionUri after consent.
  3. For user-delegated flows, host an HTTPS callback, register it with UpdateWorkloadIdentity as an allowed return URL, and call CompleteResourceTokenAuth after checking the user's session.
  4. Ask for refresh tokens in the provider's own way, such as access_type=offline in customParameters for Google or the offline_access scope for Microsoft and Atlassian.
  5. Treat a returned token as possibly revoked. On a 401 from the resource server, retry with forceAuthentication set to true.

WorkOS Pipes and Agents

  1. Call POST /data-integrations/{provider}/token with user_id for each use and don't cache the token
  2. Branch on active in the response and send the user to reconnect on needs_reauthorization
  3. Wait for Retry-After on a 429, or back off with jitter when it's missing
  4. Use lower-case provider slugs such as github or slack
  5. Revoke an agent's session through the Agents API when a task ends instead of waiting for expiry

Questions

Which is better for AI agents, Amazon Bedrock AgentCore Identity or WorkOS Pipes and Agents?

Amazon Bedrock AgentCore Identity scores 74.8 (BB) on agent readiness against WorkOS Pipes and Agents's 59.9 (C), and leads in 6 of 7 scored categories. WorkOS Pipes and Agents leads on maintenance & community.

Do Amazon Bedrock AgentCore Identity and WorkOS Pipes and Agents need an API key?

Both take an API key or an OAuth sign-in.

Can an agent call Amazon Bedrock AgentCore Identity and WorkOS Pipes and Agents without installing anything?

Yes. Amazon Bedrock AgentCore Identity has a hosted endpoint at https://bedrock-agentcore.us-east-1.amazonaws.com and WorkOS Pipes and Agents at https://api.workos.com.

Other comparisons with Amazon Bedrock AgentCore Identity or WorkOS Pipes and Agents

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report