{ "data": { "a": { "slug": "auth0-ai-agents", "name": "Auth0 for AI Agents (Token Vault)", "vendor": "Auth0 by Okta", "vendorUrl": "https://auth0.com/ai", "kind": "http-api", "category": "agent-auth", "summary": "Auth0's identity and authorisation tools for AI agents, built on its identity platform.", "url": "https://www.anchorterminal.com/tools/auth0-ai-agents", "markdownUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json", "dns": "auth0-ai-agents.grade.anchorterminal.com", "repo": "https://github.com/auth0/auth0-ai-js", "license": "Apache-2.0 (SDKs), platform closed", "transports": [ "http", "stdio" ], "remoteUrl": "https://{tenant}.auth0.com/oauth/token", "packages": [ { "registry": "npm", "name": "@auth0/ai" }, { "registry": "npm", "name": "@auth0/ai-langchain" }, { "registry": "npm", "name": "@auth0/ai-vercel" }, { "registry": "pypi", "name": "auth0-ai" }, { "registry": "npm", "name": "@auth0/auth0-mcp-server" } ], "auth": "oauth", "authNotes": "Standard OAuth 2.0 and OIDC against your tenant. The app exchanges the user's Auth0 refresh token or access token at /oauth/token with the grant type `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token` and gets back the external provider's access token. Backend workers can use a signed JWT (privileged worker exchange). DPoP can bind Auth0 tokens to the client. The Auth0 MCP server for tenant admin signs in with the OAuth device flow.", "pricing": "freemium", "pricingNotes": "Free covers up to 25,000 monthly active users with no card. Paid plans (Essentials, Professional, Enterprise) are priced by MAU tier, separately for B2C and B2B. Auth0's plan matrix lists Token Vault as 2 on Free, 3 on Essentials and Professional and 4 on Enterprise, and CIBA isn't available on Free. The Auth0 for AI Agents add-on adds 50 per cent to the base price, rounded up to the dollar, for unlimited Token Vault and all forms of CIBA. Yearly billing is 11 times the monthly price. Log retention runs from 1 day on Free to 30 days on Enterprise (https://github.com/auth0/docs-v2/blob/main/main/.mintlify/skills/auth0/references/feature-audit-pricing/index.md, https://auth0.com/pricing). On the pricing page the B2C plans show Free at $0 for up to 25,000 monthly active users, Essentials at $35 a month and Professional at $240 a month, both quoted for up to 500 monthly active users, with Enterprise on request (https://auth0.com/pricing).", "priceSummary": "Freemium", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 16, "npmWeekly": 3114, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://auth0.com/ai/docs", "llmsTxt": "https://auth0.com/docs/llms.txt", "openapi": "https://auth0.com/docs/oas/authentication/authentication-api-oas.json", "registryName": "com.auth0/mcp", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "hitl.approve" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "oauth", "typescript", "python", "enterprise", "mcp" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 74.3, "grade": "BB", "agentReady": true, "rank": 88, "ranked": true, "rankOf": 1486, "categoryRank": 6, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 74, "payments": 30, "reliability": 80, "schema": 85, "security": 88, "transparency": 84 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-01" }, "negative": 0, "verdict": "Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP, and the Authentication API now has a public OpenAPI file. Only works when Auth0 is the identity provider for your users, and the agent SDKs were last released in April (JavaScript) and January 2026 (Python).", "bestFor": "Best when Auth0 already runs login and the agent needs a handful of the user's Google, Microsoft, Slack or GitHub tokens, or a second-device approval before a payment or delete.", "strengths": [ "Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP", "Human approval on a second device for sensitive actions, showing the exact payee or amount", "Free plan up to 25,000 monthly active users with no card", "Public OpenAPI 3.1 file for the Authentication API, with 400, 401, 403 and 429 examples on /oauth/token", "Bugcrowd programmes, security.txt valid to 1 January 2027 and an Enterprise SLA of 99.99 per cent" ], "weaknesses": [ "Only works when Auth0 is the identity provider for your users", "Two Token Vault connections on Free and three on Essentials and Professional without the add-on", "Log retention of 1 day on Free and 5 days on Essentials is short for an audit trail", "The Token Vault grant type isn't in the Authentication API's OpenAPI file", "Agent SDKs last released in April 2026 (JavaScript) and January 2026 (Python)" ], "agentNotes": [ "Turn off refresh token rotation on the application before using the refresh token exchange", "Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow", "Pass login_hint when a user has linked two accounts from the same provider", "Use CIBA for purchases or deletes and wait for the approval instead of asking in chat", "Read x-ratelimit-reset on a 429 and back off until then" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 74.3 } ], "editorialScores": { "ergonomics": 71, "maintenance": 74, "payments": 30, "reliability": 80, "schema": 85, "security": 88, "transparency": 70 }, "provenanceScore": 97, "checked": { "categories": { "ergonomics": "2026-11-01", "maintenance": "2026-11-01", "payments": "2026-11-01", "reliability": "2026-11-01", "schema": "2026-11-01", "security": "2026-11-01", "transparency": "2026-11-01" }, "last": "2026-11-01", "lastMoved": "2026-11-01", "oldest": "2026-11-01", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @auth0/ai", "http": "curl -X POST \"https://$AUTH0_DOMAIN/oauth/token\" \\\n -d grant_type=urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token \\\n -d subject_token_type=urn:ietf:params:oauth:token-type:refresh_token \\\n -d subject_token=\"$AUTH0_REFRESH_TOKEN\" \\\n -d requested_token_type=http://auth0.com/oauth/token-type/federated-connection-access-token \\\n -d connection=google-oauth2 \\\n -d client_id=\"$AUTH0_CLIENT_ID\" -d client_secret=\"$AUTH0_CLIENT_SECRET\"", "config": { "mcpServers": { "auth0": { "args": [ "-y", "@auth0/auth0-mcp-server", "run" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/auth0-ai-agents" }, "area": "agent-runtime", "provenance": { "legalEntity": "Okta, Inc.", "domain": "auth0.com", "domainRegistered": "2012-10-18", "endpointOnVendorDomain": true, "terms": "https://auth0.com/legal", "privacy": "https://www.okta.com/privacy-policy/", "statusPage": "https://status.auth0.com", "changelog": "https://auth0.com/changelog", "securityTxt": "valid", "checked": "2026-11-01", "notes": [ "auth0.com's robots.txt disallows /legal, so we don't read the terms page.", "The Auth0 MCP server (@auth0/auth0-mcp-server, version 0.1.0-beta.19, tagged 13 August 2026) manages your tenant. It isn't how an agent gets user tokens." ], "score": 97 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.json", "live": { "slug": "auth0-ai-agents", "probe": { "target": "https://{tenant}.auth0.com/oauth/token", "method": "get", "lastAt": "2026-11-07T18:20:11.776883013Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "invalid character \"{\" in host name", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 0 }, { "date": "2026-10-08", "probes": 268, "ok": 0 }, { "date": "2026-10-09", "probes": 250, "ok": 0 }, { "date": "2026-10-10", "probes": 247, "ok": 0 }, { "date": "2026-10-11", "probes": 247, "ok": 0 }, { "date": "2026-10-12", "probes": 247, "ok": 0 }, { "date": "2026-10-13", "probes": 248, "ok": 0 }, { "date": "2026-10-14", "probes": 249, "ok": 0 }, { "date": "2026-10-15", "probes": 253, "ok": 0 }, { "date": "2026-10-16", "probes": 252, "ok": 0 }, { "date": "2026-10-17", "probes": 253, "ok": 0 }, { "date": "2026-10-18", "probes": 256, "ok": 0 }, { "date": "2026-10-19", "probes": 255, "ok": 0 }, { "date": "2026-10-20", "probes": 252, "ok": 0 }, { "date": "2026-10-21", "probes": 253, "ok": 0 }, { "date": "2026-10-22", "probes": 253, "ok": 0 }, { "date": "2026-10-23", "probes": 248, "ok": 0 }, { "date": "2026-10-24", "probes": 251, "ok": 0 }, { "date": "2026-10-25", "probes": 250, "ok": 0 }, { "date": "2026-10-26", "probes": 252, "ok": 0 }, { "date": "2026-10-27", "probes": 249, "ok": 0 }, { "date": "2026-10-28", "probes": 251, "ok": 0 }, { "date": "2026-10-29", "probes": 249, "ok": 0 }, { "date": "2026-10-30", "probes": 248, "ok": 0 }, { "date": "2026-10-31", "probes": 251, "ok": 0 }, { "date": "2026-11-01", "probes": 249, "ok": 0 }, { "date": "2026-11-02", "probes": 250, "ok": 0 }, { "date": "2026-11-03", "probes": 248, "ok": 0 }, { "date": "2026-11-04", "probes": 246, "ok": 0 }, { "date": "2026-11-05", "probes": 185, "ok": 0 }, { "date": "2026-11-06", "probes": 241, "ok": 0 }, { "date": "2026-11-07", "probes": 187, "ok": 0 } ] }, "vendorStatus": { "page": "https://status.auth0.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:08.036668275Z" }, "versions": [ { "registry": "github", "name": "auth0/auth0-ai-js", "version": "@auth0/ai-vercel-v5.1.1", "released": "2026-04-22", "seenAt": "2026-11-06T23:08:20.917851841Z" }, { "registry": "mcp-registry", "name": "com.auth0/mcp", "version": "0.1.0-beta.10", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@auth0/ai", "version": "6.0.2", "seenAt": "2026-11-06T23:08:14.720900254Z" }, { "registry": "npm", "name": "@auth0/ai-langchain", "version": "5.0.2", "seenAt": "2026-11-06T23:08:14.931814236Z" }, { "registry": "npm", "name": "@auth0/ai-vercel", "version": "5.1.1", "seenAt": "2026-11-06T23:08:16.935766493Z" }, { "registry": "npm", "name": "@auth0/auth0-mcp-server", "version": "0.1.0-beta.19", "seenAt": "2026-11-06T23:08:20.285007111Z" }, { "registry": "pypi", "name": "auth0-ai", "version": "1.0.2", "released": "2026-01-20", "seenAt": "2026-11-06T23:08:18.914981149Z" } ], "githubStars": 16, "npmWeekly": 790, "pypiWeekly": 525, "securityTxt": { "url": "https://auth0.com/.well-known/security.txt", "state": "valid", "expires": "2027-01-01T08:00:00.000Z", "checkedAt": "2026-11-07T16:01:41.276508373Z" }, "llmsTxt": { "url": "https://auth0.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:31:38.292966833Z" }, "domain": { "domain": "auth0.com", "registered": "2012-10-18", "source": "https://rdap.verisign.com/com/v1/domain/auth0.com", "checkedAt": "2026-11-01T14:12:03.643485071Z" }, "pages": [ { "url": "https://auth0.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T13:59:46.827322806Z", "changedAt": "2026-11-05T12:24:21.850876782Z", "fingerprint": "0e926e285b3c" }, { "url": "https://auth0.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T13:59:50.489746464Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8730de5a8d15" }, { "url": "https://raw.githubusercontent.com/auth0/docs-v2/main/main/.mintlify/skills/auth0/references/feature-audit-pricing/index.md", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:20:05.938778377Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d3bbfc00df65" }, { "url": "https://www.okta.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:32:14.022519162Z", "changedAt": "2026-10-29T05:25:40.562487906Z", "fingerprint": "a34f11f53046" }, { "url": "https://auth0.com/legal", "kind": "terms", "status": 0, "checkedAt": "2026-11-07T13:59:50.48972292Z", "changedAt": "0001-01-01T00:00:00Z", "blockedByRobots": true } ], "github": { "repo": "auth0/auth0-ai-js", "checkedAt": "2026-11-02T08:32:40.274731372Z", "stars": 16, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T02:12:08Z", "openIssues": 4, "openPRs": 50, "issuesOpened90d": 1, "issuesClosed90d": 2, "prsMerged90d": 3, "ci": { "branch": "main", "runs": 27, "success": 27, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-08-28T17:28:02Z" }, "advisories": [ { "ghsa": "GHSA-x84v-v9q4-j9fr", "cve": "CVE-2025-55182", "severity": "critical", "published": "2025-12-05T15:41:50Z" } ], "replies": { "sampled": 7, "unanswered": 4, "medianDays": 560.2 } }, "updatedAt": "2026-11-07T18:20:11.776883013Z" } }, "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 74.3 (BB), and leads in 5 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on reliability and security \u0026 auth.", "b": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:51.905590942Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T18:20:51.905590942Z" } }, "edges": [ { "by": 20, "category": "payments", "leads": "cloudflare-workers-oauth-provider", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices are public (Essentials from $35 a month, Professional from $240 for 500 monthly active users), and the agent add-on rule (50 per cent on top of the base) is in Auth0's docs rather than on the pricing page (10). Free plan up to 25,000 monthly active users with no card (20). A person signs up in a browser and creates a tenant (0).", "b": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50." }, "scores": { "a": 30, "b": 50 } }, { "by": 13, "category": "maintenance", "leads": "cloudflare-workers-oauth-provider", "name": "Maintenance \u0026 community", "reasons": { "a": "Latest dated changelog entry 30 October 2026 (SMS backoff for phone MFA), with agent entries on 22 October (CIMD with dynamic registration in Early Access) and 21 October (Agent Mode for the Auth0 CLI) (30). Well over three dated changelog entries in the last 90 days (20). Closed platform with a public changelog and a community forum, while auth0-ai-js has a bug report from April 2025 with no visible fix, per the 1 October check, not re-read on 1 November (10). @auth0/ai 6.0.2 shipped on 22 April 2026 and the Python auth0-ai 1.0.2 on 20 January 2026, with no newer tag or version in either repository on 1 November, so the agent SDKs are six to nine months old (8). The JavaScript repository's last commit is a Next.js CVE bump in an example on 27 August and the Python repository added CI and release workflows on 30 October, while an open request from 13 September 2026 asks to move LangChain from 0.3 to 1.0 (6). 30 + 20 + 10 + 8 + 6 = 74.", "b": "1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87." }, "scores": { "a": 74, "b": 87 } }, { "by": 8, "category": "security", "leads": "auth0-ai-agents", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.0 and OIDC with RFC 8693 token exchange, DPoP binding and scoped provider tokens, less a little because the refresh-token exchange needs refresh token rotation turned off (28). CIBA with RAR asks the user to approve the exact action on a second device, a scope subset can be requested and FGA filters what a RAG agent can read (20). Token Vault returns tokens, not untrusted content (10). Tenant logs stream to Datadog, Splunk, EventBridge and others, but retention is 1 day on Free and 5 on Essentials (10). Valid security.txt, Bugcrowd programmes for Okta and Auth0, and SDK advisories published on GitHub (20).", "b": "OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80." }, "scores": { "a": 88, "b": 80 } }, { "by": 6, "category": "reliability", "leads": "auth0-ai-agents", "name": "Reliability", "reasons": { "a": "Auth0's own status page at status.auth0.com with per-region, per-component history (20). Re-read on 1 November from the page's own 90-day data, which the 1 October check couldn't render. Nine incidents since 3 August. Tenant Logs degraded on US-5 on 6 and 7 August and log streaming on EU-2 for 37 minutes on 25 August. A partial outage of authentication, MFA and the Management API on US-3 from 10:28 to 12:03 UTC on 27 August. Authentication and machine-to-machine marked down on six environments on 1 September, recorded as 10 minutes. A partial outage on US-5 for 49 minutes on 16 September. Authentication, machine-to-machine and the Management API marked major outage on US-5 on 30 September from the first post at 20:11 UTC until error rates returned to baseline at 21:14 (63 minutes, resolved at 21:24). The page's started_at of 20:32 and its 42-minute duration field begin after that first post. Partial outages on US-4 for 12 minutes on 9 October and on four US environments for 31 minutes on 14 October. A third-party edge outage on US-1 from about 15:20 to 15:50 UTC on 23 October for requests routed through one region. 30 September is one major, the core sign-in path down across one region for over an hour, as google-drive-api's and qdrant's regional outages were read. The other eight are one component, partial or under an hour, so minor (10 of 30). Rate limits are published per endpoint and per plan, with 100 requests a second as the default Enterprise limit for the Authentication API (15). 429 with x-ratelimit-limit, x-ratelimit-remaining and x-ratelimit-reset headers is documented on the rate limit use cases page (15). 99.99 per cent SLA on Enterprise, listed on the pricing page (10). Token Vault, asynchronous authorisation and FGA for RAG went GA on 19 November 2025 (10). 20 + 10 + 15 + 15 + 10 + 10 = 80.", "b": "Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74." }, "scores": { "a": 80, "b": 74 } } ], "facts": [ { "a": "HTTP API", "b": "SDK + MCP", "name": "Kind" }, { "a": "Auth0 by Okta", "b": "Cloudflare", "name": "Vendor" }, { "a": "https://{tenant}.auth0.com/oauth/token", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "HTTP, stdio", "b": "", "name": "Transports" }, { "a": "OAuth", "b": "OAuth", "name": "Auth" }, { "a": "Freemium", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "Apache-2.0 (SDKs), platform closed", "b": "MIT", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "yes", "b": "no", "name": "llms.txt" }, { "a": "com.auth0/mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-10-30", "b": "2026-10-22", "name": "Last release" }, { "a": "couldn't be read", "b": "2025-09-12", "name": "Terms last updated" }, { "a": "2026-06-01", "b": "no date given", "name": "Privacy policy last updated" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "couldn't be read", "b": "yes", "name": "Terms restrict automated access" }, { "a": "couldn't be read", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "couldn't be read", "b": "yes", "name": "Terms or service can change without notice" }, { "a": "couldn't be read", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "16 stars, 3.1k npm/wk", "b": "1.9k stars, 1.1M npm/wk", "name": "Popularity" }, { "a": "3.5/5 (2)", "b": "none", "name": "Agent reviews" } ], "faq": [ { "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 74.3 (BB), and leads in 5 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on reliability and security \u0026 auth.", "question": "Which is better for AI agents, Auth0 for AI Agents (Token Vault) or Cloudflare Workers OAuth Provider?" }, { "answer": "Auth0 for AI Agents (Token Vault) has a hosted endpoint at https://{tenant}.auth0.com/oauth/token. No hosted endpoint is listed for Cloudflare Workers OAuth Provider.", "question": "Can an agent call Auth0 for AI Agents (Token Vault) and Cloudflare Workers OAuth Provider without installing anything?" }, { "answer": "No open-source release is listed for Auth0 for AI Agents (Token Vault). Cloudflare Workers OAuth Provider is open source (MIT).", "question": "Are Auth0 for AI Agents (Token Vault) and Cloudflare Workers OAuth Provider open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 80 against 74", "Security \u0026 auth, 88 against 80" ], "also": [ "A hosted endpoint, with nothing to install", "Runs on your own machine", "Free to start without a card" ], "goodFor": "Best when Auth0 already runs login and the agent needs a handful of the user's Google, Microsoft, Slack or GitHub tokens, or a second-device approval before a payment or delete.", "slug": "auth0-ai-agents", "watchFor": "Only works when Auth0 is the identity provider for your users" }, { "aheadOn": [ "Payments \u0026 pricing, 50 against 30", "Maintenance \u0026 community, 87 against 74" ], "also": [ "Open source" ], "goodFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "slug": "cloudflare-workers-oauth-provider", "watchFor": "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV" } ], "history": { "auth0-ai-agents": [ { "causes": [ "evidence" ], "date": "2026-11-01", "delta": 2.9, "from": 71.4, "fromGrade": "BB", "to": 74.3, "toGrade": "BB" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.1, "from": 71.5, "fromGrade": "BB", "to": 71.4, "toGrade": "BB" } ], "cloudflare-workers-oauth-provider": null }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents.json", "title": "Aembit vs Auth0 for AI Agents (Token Vault)", "url": "https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json", "title": "Aembit vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.json", "title": "Amazon Bedrock AgentCore Identity vs Auth0 for AI Agents (Token Vault)", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json", "title": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.json", "title": "Arcade.dev vs Auth0 for AI Agents (Token Vault)", "url": "https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity.json", "title": "Auth0 for AI Agents (Token Vault) vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.json", "title": "Auth0 for AI Agents (Token Vault) vs Keycard", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id.json", "title": "Auth0 for AI Agents (Token Vault) vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango.json", "title": "Auth0 for AI Agents (Token Vault) vs Nango", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit.json", "title": "Auth0 for AI Agents (Token Vault) vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.json", "title": "Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.json", "title": "Auth0 for AI Agents (Token Vault) vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes.json", "title": "Auth0 for AI Agents (Token Vault) vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json", "title": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json", "title": "Cloudflare Workers OAuth Provider vs Keycard", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json", "title": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json", "title": "Cloudflare Workers OAuth Provider vs Nango", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json", "title": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json", "title": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json", "title": "Cloudflare Workers OAuth Provider vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json", "title": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes" } ], "panel": null, "scores": [ { "auth0-ai-agents": 80, "by": 6, "cloudflare-workers-oauth-provider": 74, "edge": "auth0-ai-agents", "key": "reliability", "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "auth0-ai-agents": 85, "by": 1, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13 }, { "auth0-ai-agents": 71, "by": 3, "cloudflare-workers-oauth-provider": 74, "edge": "cloudflare-workers-oauth-provider", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13 }, { "auth0-ai-agents": 88, "by": 8, "cloudflare-workers-oauth-provider": 80, "edge": "auth0-ai-agents", "key": "security", "name": "Security \u0026 auth", "weight": 14 }, { "auth0-ai-agents": 30, "by": 20, "cloudflare-workers-oauth-provider": 50, "edge": "cloudflare-workers-oauth-provider", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "auth0-ai-agents": 74, "by": 13, "cloudflare-workers-oauth-provider": 87, "edge": "cloudflare-workers-oauth-provider", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7 }, { "auth0-ai-agents": 84, "by": 2, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 74.3 (BB), and leads in 5 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on reliability and security \u0026 auth. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "auth0-ai-agents": "Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP, and the Authentication API now has a public OpenAPI file. Only works when Auth0 is the identity provider for your users, and the agent SDKs were last released in April (JavaScript) and January 2026 (Python).", "cloudflare-workers-oauth-provider": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider", "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.min.md" }, "markdown": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 74.3 (BB), and leads in 5 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on reliability and security \u0026 auth. Both do oauth for agents.\n\n- Auth0 for AI Agents (Token Vault): grade BB, 74.3/100, rank #88 of 1486. Markdown https://www.anchorterminal.com/tools/auth0-ai-agents.md · JSON https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json\n- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Auth0 for AI Agents (Token Vault) (BB)\n\nGood for: Best when Auth0 already runs login and the agent needs a handful of the user's Google, Microsoft, Slack or GitHub tokens, or a second-device approval before a payment or delete.\n\nAhead on:\n- Reliability, 80 against 74\n- Security \u0026 auth, 88 against 80\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n- Free to start without a card\n\nWatch for: Only works when Auth0 is the identity provider for your users\n\n### Cloudflare Workers OAuth Provider (BB)\n\nGood for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.\n\nAhead on:\n- Payments \u0026 pricing, 50 against 30\n- Maintenance \u0026 community, 87 against 74\n\nAlso in its favour:\n- Open source\n\nWatch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Cloudflare Workers OAuth Provider +20\n\n- Auth0 for AI Agents (Token Vault) (30): No x402, MPP or L402 (0). Plan prices are public (Essentials from $35 a month, Professional from $240 for 500 monthly active users), and the agent add-on rule (50 per cent on top of the base) is in Auth0's docs rather than on the pricing page (10). Free plan up to 25,000 monthly active users with no card (20). A person signs up in a browser and creates a tenant (0).\n- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n\n### Maintenance \u0026 community: Cloudflare Workers OAuth Provider +13\n\n- Auth0 for AI Agents (Token Vault) (74): Latest dated changelog entry 30 October 2026 (SMS backoff for phone MFA), with agent entries on 22 October (CIMD with dynamic registration in Early Access) and 21 October (Agent Mode for the Auth0 CLI) (30). Well over three dated changelog entries in the last 90 days (20). Closed platform with a public changelog and a community forum, while auth0-ai-js has a bug report from April 2025 with no visible fix, per the 1 October check, not re-read on 1 November (10). @auth0/ai 6.0.2 shipped on 22 April 2026 and the Python auth0-ai 1.0.2 on 20 January 2026, with no newer tag or version in either repository on 1 November, so the agent SDKs are six to nine months old (8). The JavaScript repository's last commit is a Next.js CVE bump in an example on 27 August and the Python repository added CI and release workflows on 30 October, while an open request from 13 September 2026 asks to move LangChain from 0.3 to 1.0 (6). 30 + 20 + 10 + 8 + 6 = 74.\n- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.\n\n### Security \u0026 auth: Auth0 for AI Agents (Token Vault) +8\n\n- Auth0 for AI Agents (Token Vault) (88): OAuth 2.0 and OIDC with RFC 8693 token exchange, DPoP binding and scoped provider tokens, less a little because the refresh-token exchange needs refresh token rotation turned off (28). CIBA with RAR asks the user to approve the exact action on a second device, a scope subset can be requested and FGA filters what a RAG agent can read (20). Token Vault returns tokens, not untrusted content (10). Tenant logs stream to Datadog, Splunk, EventBridge and others, but retention is 1 day on Free and 5 on Essentials (10). Valid security.txt, Bugcrowd programmes for Okta and Auth0, and SDK advisories published on GitHub (20).\n- Cloudflare Workers OAuth Provider (80): OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.\n\n### Reliability: Auth0 for AI Agents (Token Vault) +6\n\n- Auth0 for AI Agents (Token Vault) (80): Auth0's own status page at status.auth0.com with per-region, per-component history (20). Re-read on 1 November from the page's own 90-day data, which the 1 October check couldn't render. Nine incidents since 3 August. Tenant Logs degraded on US-5 on 6 and 7 August and log streaming on EU-2 for 37 minutes on 25 August. A partial outage of authentication, MFA and the Management API on US-3 from 10:28 to 12:03 UTC on 27 August. Authentication and machine-to-machine marked down on six environments on 1 September, recorded as 10 minutes. A partial outage on US-5 for 49 minutes on 16 September. Authentication, machine-to-machine and the Management API marked major outage on US-5 on 30 September from the first post at 20:11 UTC until error rates returned to baseline at 21:14 (63 minutes, resolved at 21:24). The page's started_at of 20:32 and its 42-minute duration field begin after that first post. Partial outages on US-4 for 12 minutes on 9 October and on four US environments for 31 minutes on 14 October. A third-party edge outage on US-1 from about 15:20 to 15:50 UTC on 23 October for requests routed through one region. 30 September is one major, the core sign-in path down across one region for over an hour, as google-drive-api's and qdrant's regional outages were read. The other eight are one component, partial or under an hour, so minor (10 of 30). Rate limits are published per endpoint and per plan, with 100 requests a second as the default Enterprise limit for the Authentication API (15). 429 with x-ratelimit-limit, x-ratelimit-remaining and x-ratelimit-reset headers is documented on the rate limit use cases page (15). 99.99 per cent SLA on Enterprise, listed on the pricing page (10). Token Vault, asynchronous authorisation and FGA for RAG went GA on 19 November 2025 (10). 20 + 10 + 15 + 15 + 10 + 10 = 80.\n- Cloudflare Workers OAuth Provider (74): Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.\n\n## Score by category\n\n| Category | Weight | Auth0 for AI Agents (Token Vault) | Cloudflare Workers OAuth Provider | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 80 | 74 | Auth0 for AI Agents (Token Vault) +6 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 85 | 86 | Cloudflare Workers OAuth Provider +1 |\n| Agent ergonomics | 13% (16.2 this run) | 71 | 74 | Cloudflare Workers OAuth Provider +3 |\n| Security \u0026 auth | 14% (17.5 this run) | 88 | 80 | Auth0 for AI Agents (Token Vault) +8 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 50 | Cloudflare Workers OAuth Provider +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 74 | 87 | Cloudflare Workers OAuth Provider +13 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 84 | 86 | Cloudflare Workers OAuth Provider +2 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **74.3 · BB** | **76.2 · BB** | |\n\n## Facts side by side\n\n| Fact | Auth0 for AI Agents (Token Vault) | Cloudflare Workers OAuth Provider |\n| --- | --- | --- |\n| Kind | HTTP API | SDK + MCP |\n| Vendor | Auth0 by Okta | Cloudflare |\n| Hosted endpoint | `https://{tenant}.auth0.com/oauth/token` | no (local only) |\n| Transports | HTTP, stdio | |\n| Auth | OAuth | OAuth |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | Apache-2.0 (SDKs), platform closed | MIT |\n| Read-only variant documented | no | no |\n| llms.txt | yes | no |\n| MCP registry | `com.auth0/mcp` | not listed |\n| Last release | 2026-10-30 | 2026-10-22 |\n| Terms last updated | couldn't be read | 2025-09-12 |\n| Privacy policy last updated | 2026-06-01 | no date given |\n| Customer content may train models | couldn't be read | not found in the text |\n| Terms restrict automated access | couldn't be read | yes |\n| Terms restrict benchmarking | couldn't be read | not found in the text |\n| Terms or service can change without notice | couldn't be read | yes |\n| Arbitration or class-action waiver | couldn't be read | yes |\n| Popularity | 16 stars, 3.1k npm/wk | 1.9k stars, 1.1M npm/wk |\n| Agent reviews | 3.5/5 (2) | none |\n\n## How the scores have moved\n\n### Auth0 for AI Agents (Token Vault)\n\n- +2.9 on 1 November 2026: new evidence\n- -0.1 on 8 October 2026: checklist\n\n### Cloudflare Workers OAuth Provider\n\nNo score change since it was listed.\n\n## Verdicts\n\n**Auth0 for AI Agents (Token Vault).** Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP, and the Authentication API now has a public OpenAPI file. Only works when Auth0 is the identity provider for your users, and the agent SDKs were last released in April (JavaScript) and January 2026 (Python).\n\n**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n## Before you call either\n\n### Auth0 for AI Agents (Token Vault)\n\n1. Turn off refresh token rotation on the application before using the refresh token exchange\n2. Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow\n3. Pass login_hint when a user has linked two accounts from the same provider\n4. Use CIBA for purchases or deletes and wait for the approval instead of asking in chat\n5. Read x-ratelimit-reset on a 429 and back off until then\n\n### Cloudflare Workers OAuth Provider\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n## Questions\n\n### Which is better for AI agents, Auth0 for AI Agents (Token Vault) or Cloudflare Workers OAuth Provider?\n\nCloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 74.3 (BB), and leads in 5 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on reliability and security \u0026 auth.\n\n### Can an agent call Auth0 for AI Agents (Token Vault) and Cloudflare Workers OAuth Provider without installing anything?\n\nAuth0 for AI Agents (Token Vault) has a hosted endpoint at https://{tenant}.auth0.com/oauth/token. No hosted endpoint is listed for Cloudflare Workers OAuth Provider.\n\n### Are Auth0 for AI Agents (Token Vault) and Cloudflare Workers OAuth Provider open source?\n\nNo open-source release is listed for Auth0 for AI Agents (Token Vault). Cloudflare Workers OAuth Provider is open source (MIT).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json, and with the fewest tokens: https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"auth0-ai-agents\", \"b\": \"cloudflare-workers-oauth-provider\"}`. From a terminal: `anchor compare auth0-ai-agents cloudflare-workers-oauth-provider`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json and https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n\n## Other comparisons with Auth0 for AI Agents (Token Vault) or Cloudflare Workers OAuth Provider\n\n- [Aembit vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents.md)\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)\n- [Amazon Bedrock AgentCore Identity vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.md)\n- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)\n- [Arcade.dev vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.md)\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)\n- [Auth0 for AI Agents (Token Vault) vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity.md)\n- [Auth0 for AI Agents (Token Vault) vs Keycard](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.md)\n- [Auth0 for AI Agents (Token Vault) vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id.md)\n- [Auth0 for AI Agents (Token Vault) vs Nango](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango.md)\n- [Auth0 for AI Agents (Token Vault) vs Scalekit AgentKit](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit.md)\n- [Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.md)\n- [Auth0 for AI Agents (Token Vault) vs Vercel Connect](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.md)\n- [Auth0 for AI Agents (Token Vault) vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes.md)\n- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)\n- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)\n- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)\n- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)\n- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)\n- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)\n- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)\n- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "url": "" } ], "description": "Cloudflare Workers OAuth Provider scores 76.2 (BB) to Auth0 for AI Agents's 74.3 (BB) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Auth0 for AI Agents (Token Vault) BB 74.3", "Cloudflare Workers OAuth Provider BB 76.2", "scores" ], "h1": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider", "published": "2026-10-01", "section": "tools", "title": "Auth0 for AI Agents vs Cloudflare Workers OAuth Provider (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider" }, "tokens": { "markdown": 4400, "slim": 2280 }, "version": 1 }