Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps

Auth0 for AI Agents (Token Vault)

Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP. Only works when Auth0 is the identity provider for your users.

Stytch Connected Apps

OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box. No outbound token vault, so it can't hold your users' third-party tokens.

Auth0 for AI Agents (Token Vault)

1. Turn off refresh token rotation on the application before using the refresh token exchange
2. Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow
3. Pass login_hint when a user has linked two accounts from the same provider
4. Use CIBA for purchases or deletes and wait for the approval instead of asking in chat
5. Read X-RateLimit-Reset on a 429 and back off until then

Stytch Connected Apps

1. Fetch {project-domain}/.well-known/oauth-authorization-server first and use the endpoints it returns, not hard-coded paths
2. Register with token_endpoint_auth_method none and PKCE S256 when the agent can't keep a secret
3. Expect a 401 with protected resource metadata from the MCP server, then register and authorise
4. Ask only for scopes the user's roles can grant, or the consent page will refuse them
5. Back off exponentially on a 429, since no Retry-After header is documented