{ "data": { "a": { "slug": "auth0-ai-agents", "name": "Auth0 for AI Agents (Token Vault)", "vendor": "Auth0 by Okta", "vendorUrl": "https://auth0.com/ai", "kind": "http-api", "category": "agent-auth", "summary": "Auth0's identity and authorisation tools for AI agents, built on its identity platform.", "url": "https://www.anchorterminal.com/tools/auth0-ai-agents", "markdownUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json", "repo": "https://github.com/auth0/auth0-ai-js", "license": "Apache-2.0 (SDKs), platform closed", "transports": [ "http", "stdio" ], "remoteUrl": "https://{tenant}.auth0.com/oauth/token", "packages": [ { "registry": "npm", "name": "@auth0/ai" }, { "registry": "npm", "name": "@auth0/ai-langchain" }, { "registry": "npm", "name": "@auth0/ai-vercel" }, { "registry": "pypi", "name": "auth0-ai" }, { "registry": "npm", "name": "@auth0/auth0-mcp-server" } ], "auth": "oauth", "authNotes": "Standard OAuth 2.0 and OIDC against your tenant. The app exchanges the user's Auth0 refresh token or access token at /oauth/token with the grant type `urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token` and gets back the external provider's access token. Backend workers can use a signed JWT (privileged worker exchange). DPoP can bind Auth0 tokens to the client. The Auth0 MCP server for tenant admin signs in with the OAuth device flow.", "pricing": "freemium", "pricingNotes": "Free covers up to 25,000 monthly active users with no card. Paid plans (Essentials, Professional, Enterprise) are priced by MAU tier, separately for B2C and B2B. Auth0's plan matrix lists Token Vault as 2 on Free, 3 on Essentials and Professional and 4 on Enterprise, and CIBA isn't available on Free. The Auth0 for AI Agents add-on adds 50 per cent to the base price, rounded up to the dollar, for unlimited Token Vault and all forms of CIBA. Yearly billing is 11 times the monthly price. Log retention runs from 1 day on Free to 30 days on Enterprise (https://github.com/auth0/docs-v2/blob/main/main/.mintlify/skills/auth0/references/feature-audit-pricing/index.md, https://auth0.com/pricing). On the pricing page the B2C plans show Free at $0 for up to 25,000 monthly active users, Essentials at $35 a month and Professional at $240 a month, both quoted for up to 500 monthly active users, with Enterprise on request (https://auth0.com/pricing).", "priceSummary": "Freemium", "where": "both", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 16, "npmWeekly": 3114, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://auth0.com/ai/docs", "llmsTxt": "https://auth0.com/ai/docs/llms.txt", "registryName": "com.auth0/mcp", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "hitl.approve" ], "tags": [ "hosted", "freemium", "free-tier", "no-card", "oauth", "typescript", "python", "enterprise", "mcp" ], "lastRelease": "2026-09-18", "graded": true, "anchor": { "graded": true, "score": 71.5, "grade": "BB", "agentReady": true, "rank": 82, "ranked": true, "rankOf": 452, "categoryRank": 3, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 71, "maintenance": 74, "payments": 30, "reliability": 75, "schema": 73, "security": 88, "transparency": 85 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP. Only works when Auth0 is the identity provider for your users.", "strengths": [ "Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP", "Human approval on a second device for sensitive actions, showing the exact payee or amount", "Free plan up to 25,000 monthly active users with no card", "Deprecations listed with announcement and end-of-life dates six to seven months apart", "Bugcrowd programme, valid security.txt and an Enterprise SLA of 99.99 per cent" ], "weaknesses": [ "Only works when Auth0 is the identity provider for your users", "Two Token Vault connections on Free and three on Essentials and Professional without the add-on", "Log retention of 1 day on Free and 5 days on Essentials is short for an audit trail", "No OpenAPI schema for the Authentication API that the exchange uses", "Agent SDKs last released in April 2026 (JavaScript) and January 2026 (Python)" ], "agentNotes": [ "Turn off refresh token rotation on the application before using the refresh token exchange", "Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow", "Pass login_hint when a user has linked two accounts from the same provider", "Use CIBA for purchases or deletes and wait for the approval instead of asking in chat", "Read X-RateLimit-Reset on a 429 and back off until then" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 71.5 } ], "editorialScores": { "ergonomics": 71, "maintenance": 74, "payments": 30, "reliability": 75, "schema": 73, "security": 88, "transparency": 70 }, "provenanceScore": 100 }, "connect": { "install": "npm install @auth0/ai", "http": "curl -X POST \"https://$AUTH0_DOMAIN/oauth/token\" \\\n -d grant_type=urn:auth0:params:oauth:grant-type:token-exchange:federated-connection-access-token \\\n -d subject_token_type=urn:ietf:params:oauth:token-type:refresh_token \\\n -d subject_token=\"$AUTH0_REFRESH_TOKEN\" \\\n -d requested_token_type=http://auth0.com/oauth/token-type/federated-connection-access-token \\\n -d connection=google-oauth2 \\\n -d client_id=\"$AUTH0_CLIENT_ID\" -d client_secret=\"$AUTH0_CLIENT_SECRET\"", "config": { "mcpServers": { "auth0": { "args": [ "-y", "@auth0/auth0-mcp-server", "run" ], "command": "npx" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/auth0-ai-agents" }, "area": "agent-runtime", "provenance": { "legalEntity": "Okta, Inc.", "domain": "auth0.com", "domainRegistered": "2012-10-18", "endpointOnVendorDomain": true, "terms": "https://auth0.com/legal", "privacy": "https://www.okta.com/privacy-policy/", "statusPage": "https://status.auth0.com", "changelog": "https://auth0.com/changelog", "securityTxt": "valid", "checked": "2026-09-30", "notes": [ "We couldn't read the terms page on 2026-09-30.", "The Auth0 MCP server (@auth0/auth0-mcp-server, version 0.1.0-beta.19) manages your tenant. It isn't how an agent gets user tokens." ], "score": 100 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/auth0-ai-agents.json", "live": { "slug": "auth0-ai-agents", "probe": { "target": "https://{tenant}.auth0.com/oauth/token", "method": "get", "lastAt": "2026-10-04T23:48:04.49400049Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "invalid character \"{\" in host name", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 272, "samples30d": 898, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 0 }, { "date": "2026-10-02", "probes": 248, "ok": 0 }, { "date": "2026-10-03", "probes": 271, "ok": 0 }, { "date": "2026-10-04", "probes": 270, "ok": 0 } ] }, "vendorStatus": { "page": "https://status.auth0.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-04T21:39:49.238514327Z" }, "versions": [ { "registry": "github", "name": "auth0/auth0-ai-js", "version": "@auth0/ai-vercel-v5.1.1", "released": "2026-04-22", "seenAt": "2026-10-04T16:21:15.912325367Z" }, { "registry": "mcp-registry", "name": "com.auth0/mcp", "version": "0.1.0-beta.10", "seenAt": "2026-10-04T23:42:40.113054682Z" }, { "registry": "npm", "name": "@auth0/ai", "version": "6.0.2", "seenAt": "2026-10-04T16:21:08.539398106Z" }, { "registry": "npm", "name": "@auth0/ai-langchain", "version": "5.0.2", "seenAt": "2026-10-04T16:21:10.728760999Z" }, { "registry": "npm", "name": "@auth0/ai-vercel", "version": "5.1.1", "seenAt": "2026-10-04T16:21:11.90752887Z" }, { "registry": "npm", "name": "@auth0/auth0-mcp-server", "version": "0.1.0-beta.19", "seenAt": "2026-10-04T16:21:14.12298902Z" }, { "registry": "pypi", "name": "auth0-ai", "version": "1.0.2", "released": "2026-01-20", "seenAt": "2026-10-04T16:21:13.941984722Z" } ], "githubStars": 16, "npmWeekly": 2628, "pypiWeekly": 281, "securityTxt": { "url": "https://auth0.com/.well-known/security.txt", "state": "valid", "expires": "2027-01-01T08:00:00.000Z", "checkedAt": "2026-10-04T15:15:55.13396602Z" }, "llmsTxt": { "url": "https://auth0.com/ai/docs/llms.txt", "ok": false, "status": 404, "checkedAt": "2026-10-04T15:17:16.736611989Z" }, "domain": { "domain": "auth0.com", "registered": "2012-10-18", "source": "https://rdap.verisign.com/com/v1/domain/auth0.com", "checkedAt": "2026-10-04T13:06:20.951498912Z" }, "pages": [ { "url": "https://auth0.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:41:20.178814118Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "2ecd4d6660eb" }, { "url": "https://auth0.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:41:22.566960863Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "8730de5a8d15" }, { "url": "https://raw.githubusercontent.com/auth0/docs-v2/main/main/.mintlify/skills/auth0/references/feature-audit-pricing/index.md", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:47:29.254754697Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "d3bbfc00df65" }, { "url": "https://www.okta.com/privacy-policy/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-04T15:51:31.687421551Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "be09b03a3016" }, { "url": "https://auth0.com/legal", "kind": "terms", "status": 0, "checkedAt": "2026-10-04T15:41:22.56694968Z", "changedAt": "0001-01-01T00:00:00Z", "blockedByRobots": true } ], "updatedAt": "2026-10-04T23:48:04.49400049Z" } }, "b": { "slug": "stytch-connected-apps", "name": "Stytch Connected Apps", "vendor": "Stytch (Twilio)", "vendorUrl": "https://stytch.com/connected-apps", "kind": "http-api", "category": "agent-auth", "summary": "Turns a Stytch project into an OAuth 2.1 and OIDC authorisation server so agents and MCP clients can act for your users.", "url": "https://www.anchorterminal.com/tools/stytch-connected-apps", "markdownUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/stytch-connected-apps.json", "repo": "https://github.com/stytchauth/stytch-node", "license": "MIT (SDKs), platform closed", "transports": [ "http" ], "remoteUrl": "https://api.stytch.com", "packages": [ { "registry": "npm", "name": "stytch" }, { "registry": "pypi", "name": "stytch" } ], "auth": "mixed", "authNotes": "Backend calls use HTTP basic auth with the project ID as the user and the secret as the password against api.stytch.com (test.stytch.com for test projects). Agents and MCP clients go through OAuth 2.1: metadata at `{project-domain}/.well-known/oauth-authorization-server`, registration at `/v1/oauth2/register` with no credentials, the token endpoint at `/v1/oauth2/token`, and PKCE with S256 required for public clients. The end user must already have a Stytch session when the consent page loads.", "pricing": "freemium", "pricingNotes": "Pay as you go starts at $0 with 10,000 monthly active users (people and AI agents count the same), unlimited organisations, 5 SSO or SCIM connections and 1,000 M2M tokens a month. Extra SSO or SCIM connections are $125 each, brand removal and full email customisation is a $99 one-off, and fraud fingerprints are $0.005 each after 10,000. Enterprise is custom, with volume discounts, unlimited SSO and SCIM, a 99.99 per cent SLA, a HIPAA BAA and a private Slack channel. Connected Apps has no separate line and bills through MAU (https://stytch.com/pricing, https://stytch.com/connected-apps). The page doesn't state the per-MAU overage price or whether a card is needed.", "priceSummary": "$125 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 116, "npmWeekly": 349007, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://stytch.com/docs/connected-apps/guides/mcp-auth-overview", "llmsTxt": "https://stytch.com/docs/llms.txt", "capabilities": [ "auth.oauth", "auth.consent", "auth.agent-identity", "auth.tokens" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "llms-txt", "typescript", "python", "enterprise" ], "lastRelease": "2026-08-14", "graded": true, "anchor": { "graded": true, "score": 60.8, "grade": "C", "agentReady": false, "rank": 241, "ranked": true, "rankOf": 452, "categoryRank": 6, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 62, "payments": 20, "reliability": 73, "schema": 64, "security": 66, "transparency": 66 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box. No outbound token vault, so it can't hold your users' third-party tokens.", "strengths": [ "OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box", "Revoke an app's access and all its tokens for a user with one API call", "Consent screen built from RBAC roles, so agents only see grantable scopes", "10,000 monthly active users free, agents counted as users", "No incidents on the OAuth endpoints on the status page since 1 July 2026" ], "weaknesses": [ "No outbound token vault, so it can't hold your users' third-party tokens", "Node, Python, Go and Ruby SDKs last tagged 24 June 2026, and the docs changelog last moved on 14 August", "No published rate limits for the OAuth, registration or token endpoints", "No audit log of grants and revocations that we could find", "No security.txt, and Twilio's certifications page doesn't mention Stytch" ], "agentNotes": [ "Fetch `{project-domain}/.well-known/oauth-authorization-server` first and use the endpoints it returns, not hard-coded paths", "Register with `token_endpoint_auth_method` none and PKCE S256 when the agent can't keep a secret", "Expect a 401 with protected resource metadata from the MCP server, then register and authorise", "Ask only for scopes the user's roles can grant, or the consent page will refuse them", "Back off exponentially on a 429, since no Retry-After header is documented" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.8 } ], "editorialScores": { "ergonomics": 65, "maintenance": 62, "payments": 20, "reliability": 73, "schema": 64, "security": 66, "transparency": 42 }, "provenanceScore": 90 }, "connect": { "install": "npm install stytch", "http": "curl -X POST https://api.stytch.com/v1/connected_apps/clients \\\n -u \"$STYTCH_PROJECT_ID:$STYTCH_SECRET\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"client_type\":\"third_party_public\",\"client_name\":\"My agent\",\"redirect_urls\":[\"https://example.com/callback\"]}'" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/stytch-connected-apps" }, "sameCompany": [ "twilio-voice", "sendgrid", "twilio" ], "area": "agent-runtime", "unitPrices": [ { "item": "SSO or SCIM connection above 5", "unit": "month", "usd": 125, "note": "Per connection per month on Pay as you go" }, { "item": "Fraud fingerprint above 10,000", "unit": "call", "usd": 0.005, "note": "Optional fraud add-on" } ], "provenance": { "legalEntity": "Twilio Inc.", "domain": "stytch.com", "domainRegistered": "2014-04-25", "endpointOnVendorDomain": true, "terms": "https://www.twilio.com/en-us/legal/tos", "privacy": "https://www.twilio.com/en-us/legal/privacy", "statusPage": "https://status.stytch.com", "changelog": "https://stytch.com/docs/changelog", "securityTxt": "none", "checked": "2026-10-02", "notes": [ "stytch.com/legal/terms-of-service and /legal/privacy-policy return 302 redirects to twilio.com. Twilio's terms name Twilio Inc., a Delaware corporation, and link to the last Stytch terms at twilio.com/en-us/legal/tos/stytch-tos.", "/.well-known/security.txt returned 404 on 2026-09-30, and stytch.com/security returns 404.", "status.stytch.com is an Atlassian Statuspage with an RSS history feed.", "The old changelog.stytch.com said on 2 July 2026 that it was moving into the docs. Dated entries continue at stytch.com/docs/changelog, newest 14 August 2026.", "Twilio's sub-processor page lists 13 sub-processors for Stytch by Twilio, updated September 2026." ], "score": 90 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.json", "live": { "slug": "stytch-connected-apps", "probe": { "target": "https://api.stytch.com", "method": "get", "lastAt": "2026-10-04T23:48:16.582723697Z", "lastOk": true, "lastStatus": 404, "lastMs": 444, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 441, "p95ms24h": 478, "samples24h": 272, "samples30d": 898, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 270, "ok": 270 } ] }, "vendorStatus": { "page": "https://status.stytch.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-04T21:40:30.119653254Z" }, "versions": [ { "registry": "github", "name": "stytchauth/stytch-node", "version": "v14.2.0", "released": "2026-06-24", "seenAt": "2026-10-04T16:40:57.813871092Z" }, { "registry": "npm", "name": "stytch", "version": "14.2.0", "seenAt": "2026-10-04T16:40:57.134216114Z" }, { "registry": "pypi", "name": "stytch", "version": "15.3.0", "released": "2026-06-24", "seenAt": "2026-10-04T16:40:57.623600429Z" } ], "githubStars": 116, "npmWeekly": 351245, "pypiWeekly": 174452, "securityTxt": { "url": "https://stytch.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:16:03.361419638Z" }, "llmsTxt": { "url": "https://stytch.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:18:17.1998257Z" }, "domain": { "domain": "stytch.com", "registered": "2014-04-25", "source": "https://rdap.verisign.com/com/v1/domain/stytch.com", "checkedAt": "2026-10-04T13:06:36.74420879Z" }, "pages": [ { "url": "https://stytch.com/docs/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:48:13.995093133Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "156a41d78412" }, { "url": "https://stytch.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:48:17.287254331Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "61105c9b4a8b" } ], "updatedAt": "2026-10-04T23:48:16.582723697Z" } }, "summary": "Auth0 for AI Agents (Token Vault) has a score of 71.5 (BB) against Stytch Connected Apps's 60.8 (C). Both do auth oauth. The largest gap is security \u0026 auth, 22 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps", "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.md", "slim": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.min.md" }, "markdown": "Auth0 for AI Agents (Token Vault) has a score of 71.5 (BB) against Stytch Connected Apps's 60.8 (C). Both do auth oauth. The largest gap is security \u0026 auth, 22 points.\n\n- Auth0 for AI Agents (Token Vault): grade BB, 71.5/100, rank #82 of 452. Markdown https://www.anchorterminal.com/tools/auth0-ai-agents.md · JSON https://www.anchorterminal.com/api/v1/tools/auth0-ai-agents.json\n- Stytch Connected Apps: grade C, 60.8/100, rank #241 of 452. Markdown https://www.anchorterminal.com/tools/stytch-connected-apps.md · JSON https://www.anchorterminal.com/api/v1/tools/stytch-connected-apps.json\n\n## Which one, for what\n\nPick Auth0 for AI Agents (Token Vault) for schema \u0026 documentation (+9), agent ergonomics (+6), security \u0026 auth (+22), payments \u0026 pricing (+10), maintenance \u0026 community (+12), transparency \u0026 trust (+19).\n\nPick Stytch Connected Apps for nothing in particular (no category where it leads by five points or more).\n\n## Score by category\n\n| Category | Weight | Auth0 for AI Agents (Token Vault) | Stytch Connected Apps | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 75 | 73 | Auth0 for AI Agents (Token Vault) +2 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 73 | 64 | Auth0 for AI Agents (Token Vault) +9 |\n| Agent ergonomics | 13% (16.2 this run) | 71 | 65 | Auth0 for AI Agents (Token Vault) +6 |\n| Security \u0026 auth | 14% (17.5 this run) | 88 | 66 | Auth0 for AI Agents (Token Vault) +22 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 20 | Auth0 for AI Agents (Token Vault) +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 74 | 62 | Auth0 for AI Agents (Token Vault) +12 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 85 | 66 | Auth0 for AI Agents (Token Vault) +19 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **71.5 · BB** | **60.8 · C** | |\n\n## Facts side by side\n\n| Fact | Auth0 for AI Agents (Token Vault) | Stytch Connected Apps |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Auth0 by Okta | Stytch (Twilio) |\n| Hosted endpoint | `https://{tenant}.auth0.com/oauth/token` | `https://api.stytch.com` |\n| Transports | HTTP, stdio | HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | Apache-2.0 (SDKs), platform closed | MIT (SDKs), platform closed |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | `com.auth0/mcp` | not listed |\n| Last release | 2026-09-18 | 2026-08-14 |\n| Popularity | 16 stars, 3.1k npm/wk | 116 stars, 349k npm/wk |\n| Agent reviews | 3.5/5 (2) | 3/5 (2) |\n\n## Verdicts\n\n**Auth0 for AI Agents (Token Vault).** Standard grants throughout, RFC 8693 token exchange, CIBA with RAR and DPoP. Only works when Auth0 is the identity provider for your users.\n\n**Stytch Connected Apps.** OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box. No outbound token vault, so it can't hold your users' third-party tokens.\n\n## Before you call either\n\n### Auth0 for AI Agents (Token Vault)\n\n1. Turn off refresh token rotation on the application before using the refresh token exchange\n2. Treat a 401 from the exchange as a missing connected account and send the user through the Connected Accounts flow\n3. Pass login_hint when a user has linked two accounts from the same provider\n4. Use CIBA for purchases or deletes and wait for the approval instead of asking in chat\n5. Read X-RateLimit-Reset on a 429 and back off until then\n\n### Stytch Connected Apps\n\n1. Fetch `{project-domain}/.well-known/oauth-authorization-server` first and use the endpoints it returns, not hard-coded paths\n2. Register with `token_endpoint_auth_method` none and PKCE S256 when the agent can't keep a secret\n3. Expect a 401 with protected resource metadata from the MCP server, then register and authorise\n4. Ask only for scopes the user's roles can grant, or the consent page will refuse them\n5. Back off exponentially on a 429, since no Retry-After header is documented\n\n## Other comparisons with Auth0 for AI Agents (Token Vault) or Stytch Connected Apps\n\n- [Arcade.dev vs Auth0 for AI Agents (Token Vault)](https://www.anchorterminal.com/compare/arcade-vs-auth0-ai-agents.md)\n- [Arcade.dev vs Stytch Connected Apps](https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.md)\n- [Auth0 for AI Agents (Token Vault) vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-descope-agentic-identity.md)\n- [Auth0 for AI Agents (Token Vault) vs Keycard](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.md)\n- [Auth0 for AI Agents (Token Vault) vs Nango](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango.md)\n- [Auth0 for AI Agents (Token Vault) vs Scalekit AgentKit](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit.md)\n- [Auth0 for AI Agents (Token Vault) vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes.md)\n- [Descope Agentic Identity Hub vs Stytch Connected Apps](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps.md)\n- [Keycard vs Stytch Connected Apps](https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.md)\n- [Nango vs Stytch Connected Apps](https://www.anchorterminal.com/compare/nango-vs-stytch-connected-apps.md)\n- [Scalekit AgentKit vs Stytch Connected Apps](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-stytch-connected-apps.md)\n- [Stytch Connected Apps vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/stytch-connected-apps-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps", "url": "" } ], "description": "Auth0 for AI Agents (Token Vault) has a score of 71.5 (BB) against Stytch Connected Apps's 60.8 (C). Both do auth oauth. The largest gap is security \u0026 auth, 22 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Auth0 for AI Agents (Token Vault) BB 71.5", "Stytch Connected Apps C 60.8", "scores" ], "h1": "Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps", "image": "https://www.anchorterminal.com/assets/og/compare-auth0-ai-agents-vs-stytch-connected-apps.png", "path": "/compare/auth0-ai-agents-vs-stytch-connected-apps", "published": "2026-10-01", "section": "tools", "title": "Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps", "toc": null, "updated": "2026-10-04", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps" }, "tokens": { "markdown": 1650, "slim": 380 }, "version": 1 }