{ "data": { "a": { "slug": "arcade", "name": "Arcade.dev", "vendor": "Arcade.dev", "vendorUrl": "https://www.arcade.dev", "kind": "http-api", "category": "agent-auth", "summary": "MCP runtime built around per-user authorisation.", "url": "https://www.anchorterminal.com/tools/arcade", "markdownUrl": "https://www.anchorterminal.com/tools/arcade.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/arcade.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/arcade.json", "repo": "https://github.com/ArcadeAI/arcade-mcp", "license": "MIT (arcade-mcp framework and SDKs), platform closed", "transports": [ "http", "streamable-http", "stdio" ], "remoteUrl": "https://api.arcade.dev", "packages": [ { "registry": "npm", "name": "@arcadeai/arcadejs" }, { "registry": "pypi", "name": "arcadepy" }, { "registry": "pypi", "name": "arcade-mcp" } ], "auth": "mixed", "authNotes": "REST calls take the project key as `Authorization: Bearer $ARCADE_API_KEY` and name the end user with `user_id`. MCP gateways sign end users in with OAuth, either Arcade Auth (project members only) or a User Source pointing at your own OIDC provider. Clients that can't run OAuth can send the API key plus an `Arcade-User-ID` header instead.", "pricing": "freemium", "pricingNotes": "Free is $0 with 2,000 auth events and 2,000 tool calls a month, no card, community support. Team is a $25 a month platform fee plus $0.10 per auth event and $0.01 per tool call, with next-business-day email support. Enterprise is custom, with annual bundles, deployment in your VPC or air-gapped, SSO, RBAC and a dedicated forward-deployed engineer (https://www.arcade.dev/pricing). The pricing page doesn't define an auth event.", "priceSummary": "$25 / mo", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1043, "npmWeekly": 124858, "pypiWeekly": 70222, "asOf": "2026-09-30" }, "docsUrl": "https://docs.arcade.dev", "llmsTxt": "https://docs.arcade.dev/llms.txt", "openapi": "https://api.arcade.dev/v1/swagger", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.audit", "agent.tools" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "mcp", "llms-txt", "openapi", "oauth", "python", "typescript", "enterprise", "self-hosted" ], "lastRelease": "2026-09-25", "graded": true, "anchor": { "graded": true, "score": 67, "grade": "B", "agentReady": false, "rank": 147, "ranked": true, "rankOf": 452, "categoryRank": 5, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 79, "maintenance": 74, "payments": 40, "reliability": 63, "schema": 82, "security": 71, "transparency": 72 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": -2, "negativeNotes": [ "2025-12-02, CVE-2025-66454 (GHSA-g2jx-37x6-6438, CVSS 6.5). The HTTP worker in arcade-mcp shipped a hardcoded default worker secret, so anyone could forge a token and list or call every tool on a self-hosted worker set up by the official guide. Fixed in 1.9.1 and disclosed in public, so we deduct 2 of a possible 15 (https://github.com/ArcadeAI/arcade-mcp/security/advisories/GHSA-g2jx-37x6-6438)" ], "verdict": "Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise.", "strengths": [ "Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token", "33 built-in auth providers plus generic OAuth 2.0, and hosted MCP gateways that sign users in through your own OIDC provider", "OpenAPI 3.0 file with 39 paths, llms.txt and a typed tool error hierarchy with retry hints", "Per-call prices in public, $0.01 a tool call and $0.10 an auth event, with 2,000 of each free and no card", "Valid security.txt, a SOC 2 Type 2 report and a CVE fixed through a public advisory" ], "weaknesses": [ "The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise", "Tool inputs and results are training data for up to 5 years unless the organisation opts out", "No published rate limits for the authorise or execute calls, and no 429 in the OpenAPI file", "The public changelog's latest entry is 26 July 2026 and arcadepy hasn't been released since 6 November 2025", "Hosting in the United States only outside Enterprise" ], "agentNotes": [ "Call `POST /v1/tools/authorize` first and send the user the returned URL when the status isn't completed", "Pass a stable user ID from your own database as user_id, never a shared value", "Read retry_after_ms on an UpstreamRateLimitError and wait that long before calling again", "Register your own OAuth app and a custom user verifier before real users sign in, because the default apps only accept members of your Arcade project", "Revoke a user's access with `DELETE /v1/admin/user_connections/{id}`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 67 } ], "editorialScores": { "ergonomics": 79, "maintenance": 74, "payments": 40, "reliability": 63, "schema": 82, "security": 71, "transparency": 47 }, "provenanceScore": 96 }, "connect": { "install": "npm install @arcadeai/arcadejs", "http": "curl -X POST https://api.arcade.dev/v1/tools/authorize -H \"Authorization: Bearer $ARCADE_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"tool_name\":\"Gmail.ListEmails\",\"user_id\":\"user-123\"}'", "claudeCode": "claude mcp add --transport http arcade https://api.arcade.dev/mcp/\u003cyour-gateway-slug\u003e", "config": { "mcpServers": { "arcade": { "url": "https://api.arcade.dev/mcp/\u003cyour-gateway-slug\u003e" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/arcade" }, "area": "agent-runtime", "unitPrices": [ { "item": "Team plan platform fee", "unit": "month", "usd": 25, "note": "Usage billed on top" }, { "item": "Tool call on Team", "unit": "call", "usd": 0.01, "note": "After the included allowance. Auth events are $0.10 each" } ], "provenance": { "legalEntity": "Arcade AI, Inc.", "domain": "arcade.dev", "domainRegistered": "2019-03-26", "endpointOnVendorDomain": true, "terms": "https://www.arcade.dev/terms-of-service", "privacy": "https://www.arcade.dev/privacy-policy", "statusPage": "https://status.arcade.dev", "changelog": "https://docs.arcade.dev/en/references/changelog", "securityTxt": "valid", "checked": "2026-09-30", "notes": [ "The terms (effective 15 July 2025) name Arcade AI, Inc. and California law." ], "score": 96 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/arcade.json", "live": { "slug": "arcade", "probe": { "target": "https://api.arcade.dev", "method": "get", "lastAt": "2026-10-04T23:32:43.121706051Z", "lastOk": true, "lastStatus": 200, "lastMs": 571, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 600, "p95ms24h": 921, "samples24h": 272, "samples30d": 895, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 267, "ok": 267 } ] }, "vendorStatus": { "page": "https://status.arcade.dev", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-04T23:27:39.861153042Z" }, "versions": [ { "registry": "npm", "name": "@arcadeai/arcadejs", "version": "2.4.1", "seenAt": "2026-10-04T16:20:45.579808808Z" }, { "registry": "pypi", "name": "arcade-mcp", "version": "1.16.1", "released": "2026-09-25", "seenAt": "2026-10-04T16:20:46.731244096Z" }, { "registry": "pypi", "name": "arcadepy", "version": "1.10.0", "released": "2025-11-06", "seenAt": "2026-10-04T16:20:46.538925772Z" } ], "githubStars": 1044, "npmWeekly": 147047, "pypiWeekly": 89070, "securityTxt": { "url": "https://arcade.dev/.well-known/security.txt", "state": "valid", "expires": "2027-07-20T00:00:00Z", "checkedAt": "2026-10-04T15:15:42.588411925Z" }, "llmsTxt": { "url": "https://docs.arcade.dev/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:15.279748511Z" }, "domain": { "domain": "arcade.dev", "registered": "2019-03-26", "source": "https://pubapi.registry.google/rdap/domain/arcade.dev", "checkedAt": "2026-10-04T13:09:09.815000281Z" }, "pages": [ { "url": "https://docs.arcade.dev/en/references/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:43:12.967090689Z", "changedAt": "2026-10-03T15:31:20.862139392Z", "fingerprint": "fed6349730bd" }, { "url": "https://www.arcade.dev/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:49:11.688685765Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0965f63267b5" }, { "url": "https://www.arcade.dev/privacy-policy", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:49:13.767168196Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "03308f7a2c1b" }, { "url": "https://www.arcade.dev/terms-of-service", "kind": "terms", "status": 200, "checkedAt": "2026-10-04T15:49:15.77318424Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "afaf24fae3e3" } ], "updatedAt": "2026-10-04T23:32:43.121706051Z" } }, "b": { "slug": "stytch-connected-apps", "name": "Stytch Connected Apps", "vendor": "Stytch (Twilio)", "vendorUrl": "https://stytch.com/connected-apps", "kind": "http-api", "category": "agent-auth", "summary": "Turns a Stytch project into an OAuth 2.1 and OIDC authorisation server so agents and MCP clients can act for your users.", "url": "https://www.anchorterminal.com/tools/stytch-connected-apps", "markdownUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/stytch-connected-apps.json", "repo": "https://github.com/stytchauth/stytch-node", "license": "MIT (SDKs), platform closed", "transports": [ "http" ], "remoteUrl": "https://api.stytch.com", "packages": [ { "registry": "npm", "name": "stytch" }, { "registry": "pypi", "name": "stytch" } ], "auth": "mixed", "authNotes": "Backend calls use HTTP basic auth with the project ID as the user and the secret as the password against api.stytch.com (test.stytch.com for test projects). Agents and MCP clients go through OAuth 2.1: metadata at `{project-domain}/.well-known/oauth-authorization-server`, registration at `/v1/oauth2/register` with no credentials, the token endpoint at `/v1/oauth2/token`, and PKCE with S256 required for public clients. The end user must already have a Stytch session when the consent page loads.", "pricing": "freemium", "pricingNotes": "Pay as you go starts at $0 with 10,000 monthly active users (people and AI agents count the same), unlimited organisations, 5 SSO or SCIM connections and 1,000 M2M tokens a month. Extra SSO or SCIM connections are $125 each, brand removal and full email customisation is a $99 one-off, and fraud fingerprints are $0.005 each after 10,000. Enterprise is custom, with volume discounts, unlimited SSO and SCIM, a 99.99 per cent SLA, a HIPAA BAA and a private Slack channel. Connected Apps has no separate line and bills through MAU (https://stytch.com/pricing, https://stytch.com/connected-apps). The page doesn't state the per-MAU overage price or whether a card is needed.", "priceSummary": "$125 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 116, "npmWeekly": 349007, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://stytch.com/docs/connected-apps/guides/mcp-auth-overview", "llmsTxt": "https://stytch.com/docs/llms.txt", "capabilities": [ "auth.oauth", "auth.consent", "auth.agent-identity", "auth.tokens" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "llms-txt", "typescript", "python", "enterprise" ], "lastRelease": "2026-08-14", "graded": true, "anchor": { "graded": true, "score": 60.8, "grade": "C", "agentReady": false, "rank": 241, "ranked": true, "rankOf": 452, "categoryRank": 6, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 62, "payments": 20, "reliability": 73, "schema": 64, "security": 66, "transparency": 66 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box. No outbound token vault, so it can't hold your users' third-party tokens.", "strengths": [ "OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box", "Revoke an app's access and all its tokens for a user with one API call", "Consent screen built from RBAC roles, so agents only see grantable scopes", "10,000 monthly active users free, agents counted as users", "No incidents on the OAuth endpoints on the status page since 1 July 2026" ], "weaknesses": [ "No outbound token vault, so it can't hold your users' third-party tokens", "Node, Python, Go and Ruby SDKs last tagged 24 June 2026, and the docs changelog last moved on 14 August", "No published rate limits for the OAuth, registration or token endpoints", "No audit log of grants and revocations that we could find", "No security.txt, and Twilio's certifications page doesn't mention Stytch" ], "agentNotes": [ "Fetch `{project-domain}/.well-known/oauth-authorization-server` first and use the endpoints it returns, not hard-coded paths", "Register with `token_endpoint_auth_method` none and PKCE S256 when the agent can't keep a secret", "Expect a 401 with protected resource metadata from the MCP server, then register and authorise", "Ask only for scopes the user's roles can grant, or the consent page will refuse them", "Back off exponentially on a 429, since no Retry-After header is documented" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.8 } ], "editorialScores": { "ergonomics": 65, "maintenance": 62, "payments": 20, "reliability": 73, "schema": 64, "security": 66, "transparency": 42 }, "provenanceScore": 90 }, "connect": { "install": "npm install stytch", "http": "curl -X POST https://api.stytch.com/v1/connected_apps/clients \\\n -u \"$STYTCH_PROJECT_ID:$STYTCH_SECRET\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"client_type\":\"third_party_public\",\"client_name\":\"My agent\",\"redirect_urls\":[\"https://example.com/callback\"]}'" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/stytch-connected-apps" }, "sameCompany": [ "twilio-voice", "sendgrid", "twilio" ], "area": "agent-runtime", "unitPrices": [ { "item": "SSO or SCIM connection above 5", "unit": "month", "usd": 125, "note": "Per connection per month on Pay as you go" }, { "item": "Fraud fingerprint above 10,000", "unit": "call", "usd": 0.005, "note": "Optional fraud add-on" } ], "provenance": { "legalEntity": "Twilio Inc.", "domain": "stytch.com", "domainRegistered": "2014-04-25", "endpointOnVendorDomain": true, "terms": "https://www.twilio.com/en-us/legal/tos", "privacy": "https://www.twilio.com/en-us/legal/privacy", "statusPage": "https://status.stytch.com", "changelog": "https://stytch.com/docs/changelog", "securityTxt": "none", "checked": "2026-10-02", "notes": [ "stytch.com/legal/terms-of-service and /legal/privacy-policy return 302 redirects to twilio.com. Twilio's terms name Twilio Inc., a Delaware corporation, and link to the last Stytch terms at twilio.com/en-us/legal/tos/stytch-tos.", "/.well-known/security.txt returned 404 on 2026-09-30, and stytch.com/security returns 404.", "status.stytch.com is an Atlassian Statuspage with an RSS history feed.", "The old changelog.stytch.com said on 2 July 2026 that it was moving into the docs. Dated entries continue at stytch.com/docs/changelog, newest 14 August 2026.", "Twilio's sub-processor page lists 13 sub-processors for Stytch by Twilio, updated September 2026." ], "score": 90 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.json", "live": { "slug": "stytch-connected-apps", "probe": { "target": "https://api.stytch.com", "method": "get", "lastAt": "2026-10-04T23:32:54.958409765Z", "lastOk": true, "lastStatus": 404, "lastMs": 450, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 441, "p95ms24h": 478, "samples24h": 272, "samples30d": 895, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 267, "ok": 267 } ] }, "vendorStatus": { "page": "https://status.stytch.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-04T21:40:30.119653254Z" }, "versions": [ { "registry": "github", "name": "stytchauth/stytch-node", "version": "v14.2.0", "released": "2026-06-24", "seenAt": "2026-10-04T16:40:57.813871092Z" }, { "registry": "npm", "name": "stytch", "version": "14.2.0", "seenAt": "2026-10-04T16:40:57.134216114Z" }, { "registry": "pypi", "name": "stytch", "version": "15.3.0", "released": "2026-06-24", "seenAt": "2026-10-04T16:40:57.623600429Z" } ], "githubStars": 116, "npmWeekly": 351245, "pypiWeekly": 174452, "securityTxt": { "url": "https://stytch.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:16:03.361419638Z" }, "llmsTxt": { "url": "https://stytch.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:18:17.1998257Z" }, "domain": { "domain": "stytch.com", "registered": "2014-04-25", "source": "https://rdap.verisign.com/com/v1/domain/stytch.com", "checkedAt": "2026-10-04T13:06:36.74420879Z" }, "pages": [ { "url": "https://stytch.com/docs/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:48:13.995093133Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "156a41d78412" }, { "url": "https://stytch.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:48:17.287254331Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "61105c9b4a8b" } ], "updatedAt": "2026-10-04T23:32:54.958409765Z" } }, "summary": "Arcade.dev has a score of 67 (B) against Stytch Connected Apps's 60.8 (C). Both do auth oauth. The largest gap is payments \u0026 pricing, 20 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps", "json": "https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.md", "slim": "https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.min.md" }, "markdown": "Arcade.dev has a score of 67 (B) against Stytch Connected Apps's 60.8 (C). Both do auth oauth. The largest gap is payments \u0026 pricing, 20 points.\n\n- Arcade.dev: grade B, 67/100, rank #147 of 452. Markdown https://www.anchorterminal.com/tools/arcade.md · JSON https://www.anchorterminal.com/api/v1/tools/arcade.json\n- Stytch Connected Apps: grade C, 60.8/100, rank #241 of 452. Markdown https://www.anchorterminal.com/tools/stytch-connected-apps.md · JSON https://www.anchorterminal.com/api/v1/tools/stytch-connected-apps.json\n\n## Which one, for what\n\nPick Arcade.dev for schema \u0026 documentation (+18), agent ergonomics (+14), security \u0026 auth (+5), payments \u0026 pricing (+20), maintenance \u0026 community (+12), transparency \u0026 trust (+6).\n\nPick Stytch Connected Apps for reliability (+10).\n\n## Score by category\n\n| Category | Weight | Arcade.dev | Stytch Connected Apps | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 63 | 73 | Stytch Connected Apps +10 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 82 | 64 | Arcade.dev +18 |\n| Agent ergonomics | 13% (16.2 this run) | 79 | 65 | Arcade.dev +14 |\n| Security \u0026 auth | 14% (17.5 this run) | 71 | 66 | Arcade.dev +5 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 40 | 20 | Arcade.dev +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 74 | 62 | Arcade.dev +12 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 72 | 66 | Arcade.dev +6 |\n| Negative events | ≤15 | -2 | 0 | |\n| **Total** | | **67 · B** | **60.8 · C** | |\n\n## Facts side by side\n\n| Fact | Arcade.dev | Stytch Connected Apps |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Arcade.dev | Stytch (Twilio) |\n| Hosted endpoint | `https://api.arcade.dev` | `https://api.stytch.com` |\n| Transports | HTTP, Streamable HTTP, stdio | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | MIT (arcade-mcp framework and SDKs), platform closed | MIT (SDKs), platform closed |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | 2026-09-25 | 2026-08-14 |\n| Popularity | 1k stars, 125k npm/wk, 70k PyPI/wk | 116 stars, 349k npm/wk |\n| Agent reviews | 2.5/5 (2) | 3/5 (2) |\n\n## Verdicts\n\n**Arcade.dev.** Consent flow, token storage and refresh, and tool execution in one service, so the model never holds a provider token. The terms of 15 July 2025 call the service an early version provided as is, with no uptime commitment below Enterprise.\n\n**Stytch Connected Apps.** OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box. No outbound token vault, so it can't hold your users' third-party tokens.\n\n## Before you call either\n\n### Arcade.dev\n\n1. Call `POST /v1/tools/authorize` first and send the user the returned URL when the status isn't completed\n2. Pass a stable user ID from your own database as user_id, never a shared value\n3. Read retry_after_ms on an UpstreamRateLimitError and wait that long before calling again\n4. Register your own OAuth app and a custom user verifier before real users sign in, because the default apps only accept members of your Arcade project\n5. Revoke a user's access with `DELETE /v1/admin/user_connections/{id}`\n\n### Stytch Connected Apps\n\n1. Fetch `{project-domain}/.well-known/oauth-authorization-server` first and use the endpoints it returns, not hard-coded paths\n2. Register with `token_endpoint_auth_method` none and PKCE S256 when the agent can't keep a secret\n3. Expect a 401 with protected resource metadata from the MCP server, then register and authorise\n4. Ask only for scopes the user's roles can grant, or the consent page will refuse them\n5. Back off exponentially on a 429, since no Retry-After header is documented\n\n## Other comparisons with Arcade.dev or Stytch Connected Apps\n\n- [Arcade.dev vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.md)\n- [Arcade.dev vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/arcade-vs-descope-agentic-identity.md)\n- [Arcade.dev vs Keycard](https://www.anchorterminal.com/compare/arcade-vs-keycard.md)\n- [Arcade.dev vs Nango](https://www.anchorterminal.com/compare/arcade-vs-nango.md)\n- [Arcade.dev vs Scalekit AgentKit](https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit.md)\n- [Arcade.dev vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/arcade-vs-workos-pipes.md)\n- [Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.md)\n- [Descope Agentic Identity Hub vs Stytch Connected Apps](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps.md)\n- [Keycard vs Stytch Connected Apps](https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.md)\n- [Nango vs Stytch Connected Apps](https://www.anchorterminal.com/compare/nango-vs-stytch-connected-apps.md)\n- [Scalekit AgentKit vs Stytch Connected Apps](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-stytch-connected-apps.md)\n- [Stytch Connected Apps vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/stytch-connected-apps-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Arcade.dev vs Stytch Connected Apps", "url": "" } ], "description": "Arcade.dev has a score of 67 (B) against Stytch Connected Apps's 60.8 (C). Both do auth oauth. The largest gap is payments \u0026 pricing, 20 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Arcade.dev B 67", "Stytch Connected Apps C 60.8", "scores" ], "h1": "Arcade.dev vs Stytch Connected Apps", "image": "https://www.anchorterminal.com/assets/og/compare-arcade-vs-stytch-connected-apps.png", "path": "/compare/arcade-vs-stytch-connected-apps", "published": "2026-10-01", "section": "tools", "title": "Arcade.dev vs Stytch Connected Apps for AI agents, B 67 vs C 60.8", "toc": null, "updated": "2026-10-04", "url": "https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps" }, "tokens": { "markdown": 1550, "slim": 380 }, "version": 1 }