Arcade.dev vs Auth0 for AI Agents (Token Vault)

Arcade.dev

Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise.

Auth0 for AI Agents (Token Vault)

Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP. Only works when Auth0 is the identity provider for your users.

Arcade.dev

1. Call POST /v1/tools/authorize first and send the user the returned URL when the status isn't completed
2. Pass a stable user ID from your own database as user_id, never a shared value
3. Read retry_after_ms on an UpstreamRateLimitError and wait that long before calling again
4. Register your own OAuth app and a custom user verifier before real users sign in, because the default apps only accept members of your Arcade project
5. Revoke a user's access with DELETE /v1/admin/user_connections/{id}

Auth0 for AI Agents (Token Vault)

1. Turn off refresh token rotation on the application before using the refresh token exchange
2. Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow
3. Pass login_hint when a user has linked two accounts from the same provider
4. Use CIBA for purchases or deletes and wait for the approval instead of asking in chat
5. Read X-RateLimit-Reset on a 429 and back off until then