# Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider

> Cloudflare Workers OAuth Provider scores 76.2 (BB) to Auth0 for AI Agents's 74.3 (BB) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider
- Markdown: https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md (~4,400 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 74.3 (BB), and leads in 5 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on reliability and security & auth. Both do oauth for agents.

- Auth0 for AI Agents (Token Vault): grade BB, 74.3/100, rank #88 of 1486. Markdown https://www.anchorterminal.com/tools/auth0-ai-agents.md · JSON https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json
- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json
- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md
- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md

## Which one, for what

### Auth0 for AI Agents (Token Vault) (BB)

Good for: Best when Auth0 already runs login and the agent needs a handful of the user's Google, Microsoft, Slack or GitHub tokens, or a second-device approval before a payment or delete.

Ahead on:
- Reliability, 80 against 74
- Security & auth, 88 against 80

Also in its favour:
- A hosted endpoint, with nothing to install
- Runs on your own machine
- Free to start without a card

Watch for: Only works when Auth0 is the identity provider for your users

### Cloudflare Workers OAuth Provider (BB)

Good for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.

Ahead on:
- Payments & pricing, 50 against 30
- Maintenance & community, 87 against 74

Also in its favour:
- Open source

Watch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV


## Why the edge

### Payments & pricing: Cloudflare Workers OAuth Provider +20

- Auth0 for AI Agents (Token Vault) (30): No x402, MPP or L402 (0). Plan prices are public (Essentials from $35 a month, Professional from $240 for 500 monthly active users), and the agent add-on rule (50 per cent on top of the base) is in Auth0's docs rather than on the pricing page (10). Free plan up to 25,000 monthly active users with no card (20). A person signs up in a browser and creates a tenant (0).
- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.

### Maintenance & community: Cloudflare Workers OAuth Provider +13

- Auth0 for AI Agents (Token Vault) (74): Latest dated changelog entry 30 October 2026 (SMS backoff for phone MFA), with agent entries on 22 October (CIMD with dynamic registration in Early Access) and 21 October (Agent Mode for the Auth0 CLI) (30). Well over three dated changelog entries in the last 90 days (20). Closed platform with a public changelog and a community forum, while auth0-ai-js has a bug report from April 2025 with no visible fix, per the 1 October check, not re-read on 1 November (10). @auth0/ai 6.0.2 shipped on 22 April 2026 and the Python auth0-ai 1.0.2 on 20 January 2026, with no newer tag or version in either repository on 1 November, so the agent SDKs are six to nine months old (8). The JavaScript repository's last commit is a Next.js CVE bump in an example on 27 August and the Python repository added CI and release workflows on 30 October, while an open request from 13 September 2026 asks to move LangChain from 0.3 to 1.0 (6). 30 + 20 + 10 + 8 + 6 = 74.
- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.

### Security & auth: Auth0 for AI Agents (Token Vault) +8

- Auth0 for AI Agents (Token Vault) (88): OAuth 2.0 and OIDC with RFC 8693 token exchange, DPoP binding and scoped provider tokens, less a little because the refresh-token exchange needs refresh token rotation turned off (28). CIBA with RAR asks the user to approve the exact action on a second device, a scope subset can be requested and FGA filters what a RAG agent can read (20). Token Vault returns tokens, not untrusted content (10). Tenant logs stream to Datadog, Splunk, EventBridge and others, but retention is 1 day on Free and 5 on Essentials (10). Valid security.txt, Bugcrowd programmes for Okta and Auth0, and SDK advisories published on GitHub (20).
- Cloudflare Workers OAuth Provider (80): OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.

### Reliability: Auth0 for AI Agents (Token Vault) +6

- Auth0 for AI Agents (Token Vault) (80): Auth0's own status page at status.auth0.com with per-region, per-component history (20). Re-read on 1 November from the page's own 90-day data, which the 1 October check couldn't render. Nine incidents since 3 August. Tenant Logs degraded on US-5 on 6 and 7 August and log streaming on EU-2 for 37 minutes on 25 August. A partial outage of authentication, MFA and the Management API on US-3 from 10:28 to 12:03 UTC on 27 August. Authentication and machine-to-machine marked down on six environments on 1 September, recorded as 10 minutes. A partial outage on US-5 for 49 minutes on 16 September. Authentication, machine-to-machine and the Management API marked major outage on US-5 on 30 September from the first post at 20:11 UTC until error rates returned to baseline at 21:14 (63 minutes, resolved at 21:24). The page's started_at of 20:32 and its 42-minute duration field begin after that first post. Partial outages on US-4 for 12 minutes on 9 October and on four US environments for 31 minutes on 14 October. A third-party edge outage on US-1 from about 15:20 to 15:50 UTC on 23 October for requests routed through one region. 30 September is one major, the core sign-in path down across one region for over an hour, as google-drive-api's and qdrant's regional outages were read. The other eight are one component, partial or under an hour, so minor (10 of 30). Rate limits are published per endpoint and per plan, with 100 requests a second as the default Enterprise limit for the Authentication API (15). 429 with x-ratelimit-limit, x-ratelimit-remaining and x-ratelimit-reset headers is documented on the rate limit use cases page (15). 99.99 per cent SLA on Enterprise, listed on the pricing page (10). Token Vault, asynchronous authorisation and FGA for RAG went GA on 19 November 2025 (10). 20 + 10 + 15 + 15 + 10 + 10 = 80.
- Cloudflare Workers OAuth Provider (74): Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.

## Score by category

| Category | Weight | Auth0 for AI Agents (Token Vault) | Cloudflare Workers OAuth Provider | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 80 | 74 | Auth0 for AI Agents (Token Vault) +6 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 85 | 86 | Cloudflare Workers OAuth Provider +1 |
| Agent ergonomics | 13% (16.2 this run) | 71 | 74 | Cloudflare Workers OAuth Provider +3 |
| Security & auth | 14% (17.5 this run) | 88 | 80 | Auth0 for AI Agents (Token Vault) +8 |
| Payments & pricing | 10% (12.5 this run) | 30 | 50 | Cloudflare Workers OAuth Provider +20 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 74 | 87 | Cloudflare Workers OAuth Provider +13 |
| Transparency & trust | 7% (8.8 this run) | 84 | 86 | Cloudflare Workers OAuth Provider +2 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **74.3 · BB** | **76.2 · BB** | |

## Facts side by side

| Fact | Auth0 for AI Agents (Token Vault) | Cloudflare Workers OAuth Provider |
| --- | --- | --- |
| Kind | HTTP API | SDK + MCP |
| Vendor | Auth0 by Okta | Cloudflare |
| Hosted endpoint | `https://{tenant}.auth0.com/oauth/token` | no (local only) |
| Transports | HTTP, stdio |  |
| Auth | OAuth | OAuth |
| Pricing | Freemium | Free |
| x402 | no | no |
| Licence | Apache-2.0 (SDKs), platform closed | MIT |
| Read-only variant documented | no | no |
| llms.txt | yes | no |
| MCP registry | `com.auth0/mcp` | not listed |
| Last release | 2026-10-30 | 2026-10-22 |
| Terms last updated | couldn't be read | 2025-09-12 |
| Privacy policy last updated | 2026-06-01 | no date given |
| Customer content may train models | couldn't be read | not found in the text |
| Terms restrict automated access | couldn't be read | yes |
| Terms restrict benchmarking | couldn't be read | not found in the text |
| Terms or service can change without notice | couldn't be read | yes |
| Arbitration or class-action waiver | couldn't be read | yes |
| Popularity | 16 stars, 3.1k npm/wk | 1.9k stars, 1.1M npm/wk |
| Agent reviews | 3.5/5 (2) | none |

## How the scores have moved

### Auth0 for AI Agents (Token Vault)

- +2.9 on 1 November 2026: new evidence
- -0.1 on 8 October 2026: checklist

### Cloudflare Workers OAuth Provider

No score change since it was listed.

## Verdicts

**Auth0 for AI Agents (Token Vault).** Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP, and the Authentication API now has a public OpenAPI file. Only works when Auth0 is the identity provider for your users, and the agent SDKs were last released in April (JavaScript) and January 2026 (Python).

**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.

## Before you call either

### Auth0 for AI Agents (Token Vault)

1. Turn off refresh token rotation on the application before using the refresh token exchange
2. Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow
3. Pass login_hint when a user has linked two accounts from the same provider
4. Use CIBA for purchases or deletes and wait for the approval instead of asking in chat
5. Read x-ratelimit-reset on a 429 and back off until then

### Cloudflare Workers OAuth Provider

1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope
2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`
3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0
4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency

## Questions

### Which is better for AI agents, Auth0 for AI Agents (Token Vault) or Cloudflare Workers OAuth Provider?

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Auth0 for AI Agents (Token Vault)'s 74.3 (BB), and leads in 5 of 7 scored categories. Auth0 for AI Agents (Token Vault) leads on reliability and security & auth.

### Can an agent call Auth0 for AI Agents (Token Vault) and Cloudflare Workers OAuth Provider without installing anything?

Auth0 for AI Agents (Token Vault) has a hosted endpoint at https://{tenant}.auth0.com/oauth/token. No hosted endpoint is listed for Cloudflare Workers OAuth Provider.

### Are Auth0 for AI Agents (Token Vault) and Cloudflare Workers OAuth Provider open source?

No open-source release is listed for Auth0 for AI Agents (Token Vault). Cloudflare Workers OAuth Provider is open source (MIT).


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json, and with the fewest tokens: https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "auth0-ai-agents", "b": "cloudflare-workers-oauth-provider"}`. From a terminal: `anchor compare auth0-ai-agents cloudflare-workers-oauth-provider`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json and https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json

## Other comparisons with Auth0 for AI Agents (Token Vault) or Cloudflare Workers OAuth Provider

- [Aembit vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/aembit-vs-auth0-ai-agents.md)
- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)
- [Amazon Bedrock AgentCore Identity vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/agentcore-identity-vs-auth0-ai-agents.md)
- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)
- [Arcade.dev vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.md)
- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)
- [Auth0 for AI Agents (Token Vault) vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity.md)
- [Auth0 for AI Agents (Token Vault) vs Keycard](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.md)
- [Auth0 for AI Agents (Token Vault) vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-microsoft-entra-agent-id.md)
- [Auth0 for AI Agents (Token Vault) vs Nango](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango.md)
- [Auth0 for AI Agents (Token Vault) vs Scalekit AgentKit](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit.md)
- [Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.md)
- [Auth0 for AI Agents (Token Vault) vs Vercel Connect](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.md)
- [Auth0 for AI Agents (Token Vault) vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes.md)
- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)
- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)
- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)
- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)
- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)
- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)
- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)
- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp