{ "data": { "a": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:51.905590942Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T18:20:51.905590942Z" } }, "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Keycard's 49.3 (D), and leads in 6 of 7 scored categories. Keycard leads on security \u0026 auth.", "b": { "slug": "keycard", "name": "Keycard", "vendor": "Keycard Labs", "vendorUrl": "https://www.keycard.ai", "kind": "http-api", "category": "agent-auth", "summary": "Identity and access platform for AI agents.", "url": "https://www.anchorterminal.com/tools/keycard", "markdownUrl": "https://www.anchorterminal.com/tools/keycard.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/keycard.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/keycard.json", "dns": "keycard.grade.anchorterminal.com", "repo": "https://github.com/keycardai/python-sdk", "license": "MIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on Enterprise", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.keycard.ai", "packages": [ { "registry": "pypi", "name": "keycardai-mcp" }, { "registry": "pypi", "name": "keycardai-fastmcp" }, { "registry": "npm", "name": "@keycardai/mcp" }, { "registry": "pypi", "name": "keycardai_api" } ], "auth": "mixed", "authNotes": "The management API at api.keycard.ai takes `Authorization: Bearer $KEYCARD_API_KEY` (a service account key). Agents and MCP servers talk OAuth 2.0 to their zone at `https://\u003czone-id\u003e.keycard.cloud`, discovered from `/.well-known/oauth-authorization-server`, with PKCE, dynamic client registration and RFC 8693 token exchange against the token endpoint. Application credentials are a client secret, a web identity (OIDC) or EKS workload identity. Tokens are JWTs verified against the zone's JWKS.", "pricing": "freemium", "pricingNotes": "Starter is free with 5,000 transactions a month as a hard cap, unlimited users, agents and apps, RBAC, ABAC and ReBAC policies, 7-day telemetry retention and community support. Team is $500 a month with 100,000 transactions and $1 per 1,000 after, SSO, zone policy, 90-day retention, email support and an SLA. Enterprise is custom on an annual commitment, with org and device-based policy, SCIM, Active Directory and LDAP provisioning, dedicated, BYOC or on-prem deployment, private networking, customer-managed KMS, 180-day retention, a 99.95 per cent uptime SLA and 1-hour 24/7 response on P1 issues. A transaction is recorded each time Keycard issues a credential, validates an access request or exchanges a credential (https://www.keycard.ai/pricing). The page doesn't say whether a card is needed, and its sign-up form ends with a promise to be in touch. The quickstart calls the product Early Access, with sign-up at console.keycard.ai.", "priceSummary": "$500 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1, "npmWeekly": 52, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.keycard.ai", "llmsTxt": "https://docs.keycard.ai/llms.txt", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "auth.audit" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "mcp", "llms-txt", "python", "typescript", "go", "enterprise", "self-hosted" ], "lastRelease": "2026-10-15", "graded": true, "anchor": { "graded": true, "score": 49.3, "grade": "D", "agentReady": false, "rank": 1089, "ranked": true, "rankOf": 1486, "categoryRank": 18, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 79, "payments": 30, "reliability": 15, "schema": 61, "security": 86, "transparency": 45 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -3, "negativeNotes": [ "7 September 2026. keycardai-mcp 2.3.0, a minor release, made a deployment that sets `KEYCARD_CLIENT_ID` and `KEYCARD_CLIENT_SECRET` beside another credential source fail at startup, where it used to pick the client secret, and the change is described only in that release's changelog. @keycardai/mcp 1.1.0 (6 August 2026), also a minor release, carried a breaking `feat(mcp)!` rework of the OAuth client provider. No advance notice was found for either, and repeats fold into one term, -3 (https://github.com/keycardai/python-sdk/blob/main/packages/mcp/CHANGELOG.md, https://github.com/keycardai/typescript-sdk/blob/main/packages/mcp/CHANGELOG.md)." ], "verdict": "Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, no terms of service page, and keycardai-mcp 2.3.0 changed startup behaviour in a minor release.", "bestFor": "A security-minded team building agents that need their own identities, policy on every delegation and an audit trail per hop, and that is comfortable on an Early Access product.", "strengths": [ "Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange", "Delegated grants with RFC 8693 exchange for GitHub, Google, Slack, Linear and any OAuth 2.0 provider", "Session timeline and audit log per exchange, exported hourly to S3 in OCSF Parquet", "Published per-unit price ($1 per 1,000 transactions on Team) with a transaction defined", "Valid security.txt and SOC 2 Type 2 listed in a SafeBase trust centre" ], "weaknesses": [ "Early Access with sign-up by request, and no terms of service page", "No per-token kill switch, so a revoked grant lives until the token expires, and revocation doesn't reach the provider", "Request rate limits are not given as numbers, there is no public changelog, and status.keycard.ai's robots.txt refuses automated readers", "keycardai-mcp 2.3.0, a minor release on 7 September 2026, fails at startup where several credential sources are set", "Team is $500 a month with nothing between it and the free tier" ], "agentNotes": [ "Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone", "Check `AccessContext.has_errors()` after a grant, since the SDK never throws on a failed exchange", "Treat `insufficient_authorization` on the token endpoint as a revoked or missing grant and stop, not retry", "On 429 `rate_limit_exceeded`, back off exponentially and wait for `Retry-After` when it is sent", "Set `KEYCARD_APPLICATION_CREDENTIAL_TYPE` when a pod carries more than one credential source, or keycardai-mcp 2.3.0 and later fail at startup" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 49.3 } ], "editorialScores": { "ergonomics": 60, "maintenance": 79, "payments": 30, "reliability": 15, "schema": 61, "security": 86, "transparency": 25 }, "provenanceScore": 64, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "pip install keycardai-mcp", "http": "curl \"https://api.keycard.ai/zones/$KEYCARD_ZONE_ID/sessions\" \\\n -H \"Authorization: Bearer $KEYCARD_API_KEY\"" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/keycard" }, "area": "agent-runtime", "unitPrices": [ { "item": "Team plan", "unit": "month", "usd": 500, "note": "100,000 transactions included" }, { "item": "Transactions above 100,000 on Team", "unit": "1k-calls", "usd": 1, "note": "The pricing page doesn't define a transaction" } ], "provenance": { "legalEntity": "Keycard Labs, Inc.", "domain": "keycard.ai", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://www.keycard.ai/privacy/", "statusPage": "https://status.keycard.ai", "changelog": "", "securityTxt": "valid", "checked": "2026-10-02", "notes": [ "The homepage footer names Keycard Labs, Inc., 103 Foulk Road, Suite 202, Wilmington, DE 19808. The footer's legal links on 2 October were privacy, cookie policy, a vulnerability address and the trust centre at trust.keycard.ai. We found no terms of service page (keycard.ai/terms/ returns 404) and the privacy page's body didn't load for us on 30 September or 2 October.", "RDAP for keycard.ai returned 404 at rdap.nic.ai and 429 at Identity Digital on 2026-09-30, so the registration date is blank.", "status.keycard.ai answers as a status page, though its history renders client-side and its JSON and RSS feeds returned 403 to us on 2 October.", "The docs index (73 entries) lists no changelog. The SDK repositories' CHANGELOG.md files are the nearest thing to release notes.", "The trust centre lists SOC 2 Type 1 and Type 2 reports and names Resend, Google, GitHub, Cloudflare and AWS as subprocessors." ], "score": 64 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/keycard.json", "live": { "slug": "keycard", "probe": { "target": "https://api.keycard.ai", "method": "get", "lastAt": "2026-11-07T18:20:33.167004948Z", "lastOk": true, "lastStatus": 404, "lastMs": 334, "authRequired": false, "uptime24h": 100, "uptime30d": 99.97, "p50ms24h": 303, "p95ms24h": 386, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 252 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 251, "ok": 251 }, { "date": "2026-10-29", "probes": 248, "ok": 248 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 249 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.keycard.ai", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:47:58.238067672Z" }, "versions": [ { "registry": "npm", "name": "@keycardai/mcp", "version": "2.0.8", "seenAt": "2026-11-06T23:36:45.874804438Z" }, { "registry": "pypi", "name": "keycardai-fastmcp", "version": "0.7.4", "released": "2026-11-06", "seenAt": "2026-11-06T23:36:44.15360226Z" }, { "registry": "pypi", "name": "keycardai-mcp", "version": "2.3.7", "released": "2026-11-05", "seenAt": "2026-11-06T23:36:43.868574163Z" }, { "registry": "pypi", "name": "keycardai_api", "version": "0.18.0", "released": "2026-09-25", "seenAt": "2026-11-06T23:36:46.079475127Z" } ], "githubStars": 1, "npmWeekly": 115, "pypiWeekly": 285, "securityTxt": { "url": "https://keycard.ai/.well-known/security.txt", "state": "valid", "expires": "2027-06-12T00:00:00.000Z", "checkedAt": "2026-11-07T16:00:16.229721729Z" }, "llmsTxt": { "url": "https://docs.keycard.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:32:48.867870528Z" }, "domain": { "domain": "keycard.ai", "registered": "2024-02-04", "source": "https://rdap.identitydigital.services/rdap/domain/keycard.ai", "checkedAt": "2026-11-01T14:16:14.615465944Z" }, "pages": [ { "url": "https://www.keycard.ai/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:30:29.192687587Z", "changedAt": "2026-10-08T18:28:36.483812542Z", "fingerprint": "ebe4ceb994c4" }, { "url": "https://www.keycard.ai/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:30:31.542304217Z", "changedAt": "2026-10-08T18:28:38.627980953Z", "fingerprint": "5d00b76169d9" } ], "github": { "repo": "keycardai/python-sdk", "checkedAt": "2026-11-02T08:58:20.441622711Z", "stars": 1, "archived": false, "issuesEnabled": false, "pushedAt": "2026-11-02T06:51:13Z", "openIssues": 0, "openPRs": 12, "issuesOpened90d": 0, "issuesClosed90d": 0, "prsMerged90d": 119, "ci": { "branch": "main", "runs": 50, "success": 48, "failure": 2, "other": 0, "latest": "success", "latestAt": "2026-10-22T19:51:25Z" } }, "updatedAt": "2026-11-07T18:20:33.167004948Z" } }, "edges": [ { "by": 59, "category": "reliability", "leads": "cloudflare-workers-oauth-provider", "name": "Reliability", "reasons": { "a": "Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.", "b": "status.keycard.ai answers robots.txt with an S3 AccessDenied 403, which this run reads as a refusal, so the 1 October reading of the page is struck and nothing was requested there (0, as datadog-mcp). Its history was never readable (5). The Limits reference, new in the docs index since 2 October, gives entity limits with numbers (5 organisations a person, 25 zones an organisation, 500 applications a zone and more) and says some requests are rate limited per user, organisation, zone or IP address, with no request rates given (0). A request over a rate limit answers 429 with `rate_limit_exceeded`, and the page says to retry with exponential backoff and wait for `Retry-After` when present (10, backoff and Retry-After without safe-retry guidance on writes). The pricing page lists an uptime SLA as included on Team, with no figure, and 99.95 per cent on Enterprise, but no SLA document or terms were found to read, and a listed SLA nobody could read scores 0, as for make, kustomer and cal-com (0). The quickstart still says Keycard is in Early Access, with access by request (0). 0+5+0+10+0+0 = 15." }, "scores": { "a": 74, "b": 15 } }, { "by": 41, "category": "transparency", "leads": "cloudflare-workers-oauth-provider", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.", "b": "SDKs under MIT and Apache-2.0, but there's no terms of service for the platform. keycard.ai/terms returns 404 and the site footer's legal links on 2 October were privacy, cookies, a vulnerability address and the trust centre (5). Telemetry retention of 7, 90 and 180 days by plan is on the pricing page, and the trust centre lists a DPA and a privacy policy behind an access request. The privacy page's body still didn't load for us (10). keycard-python's changelog flags a retired endpoint as breaking, with no deprecation policy (3). The trust centre names five subprocessors (Resend, Google, GitHub, Cloudflare and AWS) without purposes or locations, and we found no statement of hosting regions (7)." }, "scores": { "a": 86, "b": 45 } }, { "by": 25, "category": "schema", "leads": "cloudflare-workers-oauth-provider", "name": "Schema \u0026 documentation", "reasons": { "a": "Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.", "b": "No public OpenAPI file, though the REST client is generated from one, and the zone publishes standard OAuth discovery metadata at `/.well-known/oauth-authorization-server` (10). llms.txt and Markdown docs (10). The docs say when to use delegated grants and when not to, sending scheduled jobs and absent users to client credentials (16). Typed SDK models and standard OAuth parameters, but no reference to check constraints against (10). Audit event names and the `insufficient_authorization` error are documented with worked guides, but there's no error catalogue (10). No public changelog, only CHANGELOG.md files in the SDK repositories (5)." }, "scores": { "a": 86, "b": 61 } }, { "by": 20, "category": "payments", "leads": "cloudflare-workers-oauth-provider", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.", "b": "No x402, MPP or L402 (0). Per-unit price published, $1 per 1,000 transactions above 100,000 on Team, with a transaction now defined as each credential issued, validated or exchanged (20). Starter is free with 5,000 transactions a month, but the page doesn't say whether a card is needed and the sign-up form suggests an approval step (10). A person signs up in a browser (0)." }, "scores": { "a": 50, "b": 30 } }, { "by": 14, "category": "ergonomics", "leads": "cloudflare-workers-oauth-provider", "name": "Agent ergonomics", "reasons": { "a": "Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.", "b": "A token exchange returns one short-lived credential, so there's nothing to size (20). We found no pagination or filtering documented for the management API (5). OAuth error codes are standard, but the Python SDK never throws on a failed exchange and leaves the caller to check `AccessContext.has_errors()` (12). An exchange is safe to repeat, though nothing says so (8). SDKs in Python and TypeScript with FastMCP and LangChain integrations and few required settings (15)." }, "scores": { "a": 74, "b": 60 } }, { "by": 8, "category": "maintenance", "leads": "cloudflare-workers-oauth-provider", "name": "Maintenance \u0026 community", "reasons": { "a": "1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.", "b": "keycardai-mcp 2.3.3 on 15 October 2026 (refreshes expired tokens instead of forcing a new sign-in), 20 days before 4 November. 2.3.4 to 2.3.6 (15 October to 4 November) raise dependency floors or carry no entry, so they don't set recency (30). Releases in the 90 days from 6 August include keycardai-mcp 2.2.0 (29 August), 2.3.0 (7 September), 2.3.1, 2.3.2 and 2.3.3, and @keycardai/mcp 2.0.1 (16 September) to 2.0.3 (9 October) (20). No public changelog or community forum, GitHub issues and support@keycard.ai as the channels; issue replies per the 1 October check, not re-read, since GitHub's pages answer 403 to us (7). Python and TypeScript SDKs are current (15). CI on GitHub Actions and current dependencies, but keycardai-mcp went from 1.0.0 to 2.0.0 in a day, on 6 and 7 August 2026 (7). 30+20+7+15+7 = 79." }, "scores": { "a": 87, "b": 79 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Cloudflare", "b": "Keycard Labs", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.keycard.ai", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "MIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on Enterprise", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-22", "b": "2026-10-15", "name": "Last release" }, { "a": "2025-09-12", "b": "no document linked", "name": "Terms last updated" }, { "a": "no date given", "b": "couldn't be read", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "yes", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "1.9k stars, 1.1M npm/wk", "b": "1 stars, 52 npm/wk", "name": "Popularity" }, { "a": "none", "b": "2.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Keycard's 49.3 (D), and leads in 6 of 7 scored categories. Keycard leads on security \u0026 auth.", "question": "Which is better for AI agents, Cloudflare Workers OAuth Provider or Keycard?" }, { "answer": "No hosted endpoint is listed for Cloudflare Workers OAuth Provider. Keycard has a hosted endpoint at https://api.keycard.ai.", "question": "Can an agent call Cloudflare Workers OAuth Provider and Keycard without installing anything?" }, { "answer": "Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Keycard.", "question": "Are Cloudflare Workers OAuth Provider and Keycard open source?" } ], "goodFor": [ { "aheadOn": [ "Reliability, 74 against 15", "Schema \u0026 documentation, 86 against 61", "Agent ergonomics, 74 against 60", "Payments \u0026 pricing, 50 against 30", "Maintenance \u0026 community, 87 against 79", "Transparency \u0026 trust, 86 against 45" ], "also": [ "Agent-ready, a grade of BB or better", "Open source", "No incidents deducted, where Keycard loses 3 points for them" ], "goodFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "slug": "cloudflare-workers-oauth-provider", "watchFor": "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV" }, { "aheadOn": [ "Security \u0026 auth, 86 against 80" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "A security-minded team building agents that need their own identities, policy on every delegation and an audit trail per hop, and that is comfortable on an Early Access product.", "slug": "keycard", "watchFor": "Early Access with sign-up by request, and no terms of service page" } ], "history": { "cloudflare-workers-oauth-provider": null, "keycard": [ { "causes": [ "evidence", "correction" ], "date": "2026-11-04", "delta": -7, "from": 56.3, "fromGrade": "C", "to": 49.3, "toGrade": "D" }, { "causes": [ "evidence" ], "date": "2026-10-27", "delta": 0.1, "from": 56.2, "fromGrade": "C", "to": 56.3, "toGrade": "C" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.1, "from": 56.3, "fromGrade": "C", "to": 56.2, "toGrade": "C" } ] }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json", "title": "Aembit vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-keycard.json", "title": "Aembit vs Keycard", "url": "https://www.anchorterminal.com/compare/aembit-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json", "title": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard.json", "title": "Amazon Bedrock AgentCore Identity vs Keycard", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-keycard.json", "title": "Arcade.dev vs Keycard", "url": "https://www.anchorterminal.com/compare/arcade-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json", "title": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.json", "title": "Auth0 for AI Agents (Token Vault) vs Keycard", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json", "title": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json", "title": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json", "title": "Cloudflare Workers OAuth Provider vs Nango", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json", "title": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json", "title": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json", "title": "Cloudflare Workers OAuth Provider vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json", "title": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard.json", "title": "Descope Agentic Identity Hub vs Keycard", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id.json", "title": "Keycard vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-nango.json", "title": "Keycard vs Nango", "url": "https://www.anchorterminal.com/compare/keycard-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit.json", "title": "Keycard vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.json", "title": "Keycard vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.json", "title": "Keycard vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/keycard-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-workos-pipes.json", "title": "Keycard vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/keycard-vs-workos-pipes" } ], "panel": null, "scores": [ { "by": 59, "cloudflare-workers-oauth-provider": 74, "edge": "cloudflare-workers-oauth-provider", "key": "reliability", "keycard": 15, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 25, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "schema", "keycard": 61, "name": "Schema \u0026 documentation", "weight": 13 }, { "by": 14, "cloudflare-workers-oauth-provider": 74, "edge": "cloudflare-workers-oauth-provider", "key": "ergonomics", "keycard": 60, "name": "Agent ergonomics", "weight": 13 }, { "by": 6, "cloudflare-workers-oauth-provider": 80, "edge": "keycard", "key": "security", "keycard": 86, "name": "Security \u0026 auth", "weight": 14 }, { "by": 20, "cloudflare-workers-oauth-provider": 50, "edge": "cloudflare-workers-oauth-provider", "key": "payments", "keycard": 30, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 8, "cloudflare-workers-oauth-provider": 87, "edge": "cloudflare-workers-oauth-provider", "key": "maintenance", "keycard": 79, "name": "Maintenance \u0026 community", "weight": 7 }, { "by": 41, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "transparency", "keycard": 45, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Keycard's 49.3 (D), and leads in 6 of 7 scored categories. Keycard leads on security \u0026 auth. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "cloudflare-workers-oauth-provider": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "keycard": "Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, no terms of service page, and keycardai-mcp 2.3.0 changed startup behaviour in a minor release." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard", "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.min.md" }, "markdown": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Keycard's 49.3 (D), and leads in 6 of 7 scored categories. Keycard leads on security \u0026 auth. Both do oauth for agents.\n\n- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n- Keycard: grade D, 49.3/100, rank #1089 of 1486. Markdown https://www.anchorterminal.com/tools/keycard.md · JSON https://www.anchorterminal.com/api/v1/tools/keycard.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Cloudflare Workers OAuth Provider (BB)\n\nGood for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.\n\nAhead on:\n- Reliability, 74 against 15\n- Schema \u0026 documentation, 86 against 61\n- Agent ergonomics, 74 against 60\n- Payments \u0026 pricing, 50 against 30\n- Maintenance \u0026 community, 87 against 79\n- Transparency \u0026 trust, 86 against 45\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n- No incidents deducted, where Keycard loses 3 points for them\n\nWatch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n\n### Keycard (D)\n\nGood for: A security-minded team building agents that need their own identities, policy on every delegation and an audit trail per hop, and that is comfortable on an Early Access product.\n\nAhead on:\n- Security \u0026 auth, 86 against 80\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: Early Access with sign-up by request, and no terms of service page\n\n\n## Why the edge\n\n### Reliability: Cloudflare Workers OAuth Provider +59\n\n- Cloudflare Workers OAuth Provider (74): Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.\n- Keycard (15): status.keycard.ai answers robots.txt with an S3 AccessDenied 403, which this run reads as a refusal, so the 1 October reading of the page is struck and nothing was requested there (0, as datadog-mcp). Its history was never readable (5). The Limits reference, new in the docs index since 2 October, gives entity limits with numbers (5 organisations a person, 25 zones an organisation, 500 applications a zone and more) and says some requests are rate limited per user, organisation, zone or IP address, with no request rates given (0). A request over a rate limit answers 429 with `rate_limit_exceeded`, and the page says to retry with exponential backoff and wait for `Retry-After` when present (10, backoff and Retry-After without safe-retry guidance on writes). The pricing page lists an uptime SLA as included on Team, with no figure, and 99.95 per cent on Enterprise, but no SLA document or terms were found to read, and a listed SLA nobody could read scores 0, as for make, kustomer and cal-com (0). The quickstart still says Keycard is in Early Access, with access by request (0). 0+5+0+10+0+0 = 15.\n\n### Transparency \u0026 trust: Cloudflare Workers OAuth Provider +41\n\n- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.\n- Keycard (45): SDKs under MIT and Apache-2.0, but there's no terms of service for the platform. keycard.ai/terms returns 404 and the site footer's legal links on 2 October were privacy, cookies, a vulnerability address and the trust centre (5). Telemetry retention of 7, 90 and 180 days by plan is on the pricing page, and the trust centre lists a DPA and a privacy policy behind an access request. The privacy page's body still didn't load for us (10). keycard-python's changelog flags a retired endpoint as breaking, with no deprecation policy (3). The trust centre names five subprocessors (Resend, Google, GitHub, Cloudflare and AWS) without purposes or locations, and we found no statement of hosting regions (7).\n\n### Schema \u0026 documentation: Cloudflare Workers OAuth Provider +25\n\n- Cloudflare Workers OAuth Provider (86): Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.\n- Keycard (61): No public OpenAPI file, though the REST client is generated from one, and the zone publishes standard OAuth discovery metadata at `/.well-known/oauth-authorization-server` (10). llms.txt and Markdown docs (10). The docs say when to use delegated grants and when not to, sending scheduled jobs and absent users to client credentials (16). Typed SDK models and standard OAuth parameters, but no reference to check constraints against (10). Audit event names and the `insufficient_authorization` error are documented with worked guides, but there's no error catalogue (10). No public changelog, only CHANGELOG.md files in the SDK repositories (5).\n\n### Payments \u0026 pricing: Cloudflare Workers OAuth Provider +20\n\n- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n- Keycard (30): No x402, MPP or L402 (0). Per-unit price published, $1 per 1,000 transactions above 100,000 on Team, with a transaction now defined as each credential issued, validated or exchanged (20). Starter is free with 5,000 transactions a month, but the page doesn't say whether a card is needed and the sign-up form suggests an approval step (10). A person signs up in a browser (0).\n\n### Agent ergonomics: Cloudflare Workers OAuth Provider +14\n\n- Cloudflare Workers OAuth Provider (74): Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.\n- Keycard (60): A token exchange returns one short-lived credential, so there's nothing to size (20). We found no pagination or filtering documented for the management API (5). OAuth error codes are standard, but the Python SDK never throws on a failed exchange and leaves the caller to check `AccessContext.has_errors()` (12). An exchange is safe to repeat, though nothing says so (8). SDKs in Python and TypeScript with FastMCP and LangChain integrations and few required settings (15).\n\n### Maintenance \u0026 community: Cloudflare Workers OAuth Provider +8\n\n- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.\n- Keycard (79): keycardai-mcp 2.3.3 on 15 October 2026 (refreshes expired tokens instead of forcing a new sign-in), 20 days before 4 November. 2.3.4 to 2.3.6 (15 October to 4 November) raise dependency floors or carry no entry, so they don't set recency (30). Releases in the 90 days from 6 August include keycardai-mcp 2.2.0 (29 August), 2.3.0 (7 September), 2.3.1, 2.3.2 and 2.3.3, and @keycardai/mcp 2.0.1 (16 September) to 2.0.3 (9 October) (20). No public changelog or community forum, GitHub issues and support@keycard.ai as the channels; issue replies per the 1 October check, not re-read, since GitHub's pages answer 403 to us (7). Python and TypeScript SDKs are current (15). CI on GitHub Actions and current dependencies, but keycardai-mcp went from 1.0.0 to 2.0.0 in a day, on 6 and 7 August 2026 (7). 30+20+7+15+7 = 79.\n\n## Score by category\n\n| Category | Weight | Cloudflare Workers OAuth Provider | Keycard | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 74 | 15 | Cloudflare Workers OAuth Provider +59 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 86 | 61 | Cloudflare Workers OAuth Provider +25 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 60 | Cloudflare Workers OAuth Provider +14 |\n| Security \u0026 auth | 14% (17.5 this run) | 80 | 86 | Keycard +6 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 30 | Cloudflare Workers OAuth Provider +20 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 87 | 79 | Cloudflare Workers OAuth Provider +8 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 86 | 45 | Cloudflare Workers OAuth Provider +41 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **76.2 · BB** | **49.3 · D** | |\n\n## Facts side by side\n\n| Fact | Cloudflare Workers OAuth Provider | Keycard |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Cloudflare | Keycard Labs |\n| Hosted endpoint | no (local only) | `https://api.keycard.ai` |\n| Transports | | HTTP, Streamable HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | MIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on Enterprise |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-22 | 2026-10-15 |\n| Terms last updated | 2025-09-12 | no document linked |\n| Privacy policy last updated | no date given | couldn't be read |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | yes | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | yes | not read yet |\n| Arbitration or class-action waiver | yes | not read yet |\n| Popularity | 1.9k stars, 1.1M npm/wk | 1 stars, 52 npm/wk |\n| Agent reviews | none | 2.5/5 (2) |\n\n## How the scores have moved\n\n### Cloudflare Workers OAuth Provider\n\nNo score change since it was listed.\n\n### Keycard\n\n- -7.0 on 4 November 2026 (C to D): new evidence, correction\n- +0.1 on 27 October 2026: new evidence\n- -0.1 on 8 October 2026: checklist\n\n## Verdicts\n\n**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n**Keycard.** Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, no terms of service page, and keycardai-mcp 2.3.0 changed startup behaviour in a minor release.\n\n## Before you call either\n\n### Cloudflare Workers OAuth Provider\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n### Keycard\n\n1. Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone\n2. Check `AccessContext.has_errors()` after a grant, since the SDK never throws on a failed exchange\n3. Treat `insufficient_authorization` on the token endpoint as a revoked or missing grant and stop, not retry\n4. On 429 `rate_limit_exceeded`, back off exponentially and wait for `Retry-After` when it is sent\n5. Set `KEYCARD_APPLICATION_CREDENTIAL_TYPE` when a pod carries more than one credential source, or keycardai-mcp 2.3.0 and later fail at startup\n\n## Questions\n\n### Which is better for AI agents, Cloudflare Workers OAuth Provider or Keycard?\n\nCloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Keycard's 49.3 (D), and leads in 6 of 7 scored categories. Keycard leads on security \u0026 auth.\n\n### Can an agent call Cloudflare Workers OAuth Provider and Keycard without installing anything?\n\nNo hosted endpoint is listed for Cloudflare Workers OAuth Provider. Keycard has a hosted endpoint at https://api.keycard.ai.\n\n### Are Cloudflare Workers OAuth Provider and Keycard open source?\n\nCloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Keycard.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cloudflare-workers-oauth-provider\", \"b\": \"keycard\"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider keycard`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/keycard.json\n\n## Other comparisons with Cloudflare Workers OAuth Provider or Keycard\n\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)\n- [Aembit vs Keycard](https://www.anchorterminal.com/compare/aembit-vs-keycard.md)\n- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)\n- [Amazon Bedrock AgentCore Identity vs Keycard](https://www.anchorterminal.com/compare/agentcore-identity-vs-keycard.md)\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)\n- [Arcade.dev vs Keycard](https://www.anchorterminal.com/compare/arcade-vs-keycard.md)\n- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)\n- [Auth0 for AI Agents (Token Vault) vs Keycard](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.md)\n- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)\n- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)\n- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)\n- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)\n- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)\n- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)\n- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)\n- [Descope Agentic Identity Hub vs Keycard](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard.md)\n- [Keycard vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/keycard-vs-microsoft-entra-agent-id.md)\n- [Keycard vs Nango](https://www.anchorterminal.com/compare/keycard-vs-nango.md)\n- [Keycard vs Scalekit AgentKit](https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit.md)\n- [Keycard vs Stytch Connected Apps](https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.md)\n- [Keycard vs Vercel Connect](https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.md)\n- [Keycard vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/keycard-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cloudflare Workers OAuth Provider vs Keycard", "url": "" } ], "description": "Cloudflare Workers OAuth Provider scores 76.2 (BB) to Keycard's 49.3 (D) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cloudflare Workers OAuth Provider BB 76.2", "Keycard D 49.3", "scores" ], "h1": "Cloudflare Workers OAuth Provider vs Keycard", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cloudflare-workers-oauth-provider-vs-keycard", "published": "2026-10-01", "section": "tools", "title": "Cloudflare Workers OAuth Provider vs Keycard for AI agents (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard" }, "tokens": { "markdown": 4650, "slim": 2680 }, "version": 1 }