Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider

Auth0 for AI Agents (Token Vault) 30

No x402, MPP or L402 (0). Plan prices are public (Essentials from $35 a month, Professional from $240 for 500 monthly active users), and the agent add-on rule (50 per cent on top of the base) is in Auth0's docs rather than on the pricing page (10). Free plan up to 25,000 monthly active users with no card (20). A person signs up in a browser and creates a tenant (0).

Cloudflare Workers OAuth Provider 50

Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.

Auth0 for AI Agents (Token Vault) 74

Latest dated changelog entry 30 October 2026 (SMS backoff for phone MFA), with agent entries on 22 October (CIMD with dynamic registration in Early Access) and 21 October (Agent Mode for the Auth0 CLI) (30). Well over three dated changelog entries in the last 90 days (20). Closed platform with a public changelog and a community forum, while auth0-ai-js has a bug report from April 2025 with no visible fix, per the 1 October check, not re-read on 1 November (10). @auth0/ai 6.0.2 shipped on 22 April 2026 and the Python auth0-ai 1.0.2 on 20 January 2026, with no newer tag or version in either repository on 1 November, so the agent SDKs are six to nine months old (8). The JavaScript repository's last commit is a Next.js CVE bump in an example on 27 August and the Python repository added CI and release workflows on 30 October, while an open request from 13 September 2026 asks to move LangChain from 0.3 to 1.0 (6). 30 + 20 + 10 + 8 + 6 = 74.

Cloudflare Workers OAuth Provider 87

1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.

Auth0 for AI Agents (Token Vault) 88

OAuth 2.0 and OIDC with RFC 8693 token exchange, DPoP binding and scoped provider tokens, less a little because the refresh-token exchange needs refresh token rotation turned off (28). CIBA with RAR asks the user to approve the exact action on a second device, a scope subset can be requested and FGA filters what a RAG agent can read (20). Token Vault returns tokens, not untrusted content (10). Tenant logs stream to Datadog, Splunk, EventBridge and others, but retention is 1 day on Free and 5 on Essentials (10). Valid security.txt, Bugcrowd programmes for Okta and Auth0, and SDK advisories published on GitHub (20).

Cloudflare Workers OAuth Provider 80

OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.

Auth0 for AI Agents (Token Vault) 80

Auth0's own status page at status.auth0.com with per-region, per-component history (20). Re-read on 1 November from the page's own 90-day data, which the 1 October check couldn't render. Nine incidents since 3 August. Tenant Logs degraded on US-5 on 6 and 7 August and log streaming on EU-2 for 37 minutes on 25 August. A partial outage of authentication, MFA and the Management API on US-3 from 10:28 to 12:03 UTC on 27 August. Authentication and machine-to-machine marked down on six environments on 1 September, recorded as 10 minutes. A partial outage on US-5 for 49 minutes on 16 September. Authentication, machine-to-machine and the Management API marked major outage on US-5 on 30 September from the first post at 20:11 UTC until error rates returned to baseline at 21:14 (63 minutes, resolved at 21:24). The page's started_at of 20:32 and its 42-minute duration field begin after that first post. Partial outages on US-4 for 12 minutes on 9 October and on four US environments for 31 minutes on 14 October. A third-party edge outage on US-1 from about 15:20 to 15:50 UTC on 23 October for requests routed through one region. 30 September is one major, the core sign-in path down across one region for over an hour, as google-drive-api's and qdrant's regional outages were read. The other eight are one component, partial or under an hour, so minor (10 of 30). Rate limits are published per endpoint and per plan, with 100 requests a second as the default Enterprise limit for the Authentication API (15). 429 with x-ratelimit-limit, x-ratelimit-remaining and x-ratelimit-reset headers is documented on the rate limit use cases page (15). 99.99 per cent SLA on Enterprise, listed on the pricing page (10). Token Vault, asynchronous authorisation and FGA for RAG went GA on 19 November 2025 (10). 20 + 10 + 15 + 15 + 10 + 10 = 80.

Cloudflare Workers OAuth Provider 74

Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.