Auth0 for AI Agents (Token Vault) vs Keycard

Auth0 for AI Agents (Token Vault)

Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP. Only works when Auth0 is the identity provider for your users.

Keycard

Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.

Auth0 for AI Agents (Token Vault)

1. Turn off refresh token rotation on the application before using the refresh token exchange
2. Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow
3. Pass login_hint when a user has linked two accounts from the same provider
4. Use CIBA for purchases or deletes and wait for the approval instead of asking in chat
5. Read X-RateLimit-Reset on a 429 and back off until then

Keycard

1. Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone
2. Check AccessContext.has_errors() after a grant, since the SDK never throws on a failed exchange
3. Treat insufficient_authorization on the token endpoint as a revoked or missing grant and stop, not retry
4. Keep credentials short-lived, because revocation only stops the next issuance
5. Pin keycardai-mcp to a major version, since 1.0.0 and 2.0.0 shipped a day apart