# Cloudflare Workers OAuth Provider vs Keycard (slim)

> Cloudflare Workers OAuth Provider scores 76.2 (BB) to Keycard's 49.3 (D) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md (~4,650 tokens) · this version ~2,680 tokens · JSON https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json · canonical https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Keycard's 49.3 (D), and leads in 6 of 7 scored categories. Keycard leads on security & auth. Both do oauth for agents.

- Cloudflare Workers OAuth Provider: BB 76.2, rank #47 of 1486 · https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md
- Keycard: D 49.3, rank #1089 of 1486 · https://www.anchorterminal.com/tools/keycard.min.md
- Cloudflare Workers OAuth Provider, good for Developers putting a remote MCP server on Cloudflare behind standard OAuth. Ahead on Reliability, 74 against 15; Schema & documentation, 86 against 61; Agent ergonomics, 74 against 60; Payments & pricing, 50 against 30; Maintenance & community, 87 against 79; Transparency & trust, 86 against 45. Also Agent-ready, a grade of BB or better; Open source; No incidents deducted, where Keycard loses 3 points for them.
- Keycard, good for A security-minded team building agents that need their own identities, policy on every delegation and an audit trail per hop, and that is comfortable on an Early Access product. Ahead on Security & auth, 86 against 80. Also A hosted endpoint, with nothing to install.

| Category | Cloudflare Workers OAuth Provider | Keycard |
| --- | --- | --- |
| Reliability (16%) | 74 | 15 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 86 | 61 |
| Agent ergonomics (13%) | 74 | 60 |
| Security & auth (14%) | 80 | 86 |
| Payments & pricing (10%) | 50 | 30 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 87 | 79 |
| Transparency & trust (7%) | 86 | 45 |

| Fact (where they differ) | Cloudflare Workers OAuth Provider | Keycard |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Cloudflare | Keycard Labs |
| Hosted endpoint | no (local only) | `https://api.keycard.ai` |
| Transports |  | HTTP, Streamable HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Free | Freemium |
| Licence | MIT | MIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on Enterprise |
| llms.txt | no | yes |
| Last release | 2026-10-22 | 2026-10-15 |
| Terms last updated | 2025-09-12 | no document linked |
| Privacy policy last updated | no date given | couldn't be read |
| Customer content may train models | not found in the text | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | not found in the text | not read yet |
| Terms or service can change without notice | yes | not read yet |
| Arbitration or class-action waiver | yes | not read yet |
| Popularity | 1.9k stars, 1.1M npm/wk | 1 stars, 52 npm/wk |
| Agent reviews | none | 2.5/5 (2) |

Why the edge:
- Reliability, Cloudflare Workers OAuth Provider +59: Cloudflare Workers OAuth Provider 74 (Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.); Keycard 15 (status.keycard.ai answers robots.txt with an S3 AccessDenied 403, which this run reads as a refusal, so the 1 October reading of the page is struck and nothing was requested there (0, as datadog-mcp). Its history was never readable (5). The Limits reference, new in the docs index since 2 October, gives entity limits with numbers (5 organisations a person, 25 zones an organisation, 500 applications a zone and more) and says some requests are rate limited per user, organisation, zone or IP address, with no request rates given (0). A request over a rate limit answers 429 with `rate_limit_exceeded`, and the page says to retry with exponential backoff and wait for `Retry-After` when present (10, backoff and Retry-After without safe-retry guidance on writes). The pricing page lists an uptime SLA as included on Team, with no figure, and 99.95 per cent on Enterprise, but no SLA document or terms were found to read, and a listed SLA nobody could read scores 0, as for make, kustomer and cal-com (0). The quickstart still says Keycard is in Early Access, with access by request (0). 0+5+0+10+0+0 = 15.)
- Transparency & trust, Cloudflare Workers OAuth Provider +41: Cloudflare Workers OAuth Provider 86 (MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.); Keycard 45 (SDKs under MIT and Apache-2.0, but there's no terms of service for the platform. keycard.ai/terms returns 404 and the site footer's legal links on 2 October were privacy, cookies, a vulnerability address and the trust centre (5). Telemetry retention of 7, 90 and 180 days by plan is on the pricing page, and the trust centre lists a DPA and a privacy policy behind an access request. The privacy page's body still didn't load for us (10). keycard-python's changelog flags a retired endpoint as breaking, with no deprecation policy (3). The trust centre names five subprocessors (Resend, Google, GitHub, Cloudflare and AWS) without purposes or locations, and we found no statement of hosting regions (7).)
- Schema & documentation, Cloudflare Workers OAuth Provider +25: Cloudflare Workers OAuth Provider 86 (Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.); Keycard 61 (No public OpenAPI file, though the REST client is generated from one, and the zone publishes standard OAuth discovery metadata at `/.well-known/oauth-authorization-server` (10). llms.txt and Markdown docs (10). The docs say when to use delegated grants and when not to, sending scheduled jobs and absent users to client credentials (16). Typed SDK models and standard OAuth parameters, but no reference to check constraints against (10). Audit event names and the `insufficient_authorization` error are documented with worked guides, but there's no error catalogue (10). No public changelog, only CHANGELOG.md files in the SDK repositories (5).)
- Payments & pricing, Cloudflare Workers OAuth Provider +20: Cloudflare Workers OAuth Provider 50 (Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.); Keycard 30 (No x402, MPP or L402 (0). Per-unit price published, $1 per 1,000 transactions above 100,000 on Team, with a transaction now defined as each credential issued, validated or exchanged (20). Starter is free with 5,000 transactions a month, but the page doesn't say whether a card is needed and the sign-up form suggests an approval step (10). A person signs up in a browser (0).)
- Agent ergonomics, Cloudflare Workers OAuth Provider +14: Cloudflare Workers OAuth Provider 74 (Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.); Keycard 60 (A token exchange returns one short-lived credential, so there's nothing to size (20). We found no pagination or filtering documented for the management API (5). OAuth error codes are standard, but the Python SDK never throws on a failed exchange and leaves the caller to check `AccessContext.has_errors()` (12). An exchange is safe to repeat, though nothing says so (8). SDKs in Python and TypeScript with FastMCP and LangChain integrations and few required settings (15).)
- Maintenance & community, Cloudflare Workers OAuth Provider +8: Cloudflare Workers OAuth Provider 87 (1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.); Keycard 79 (keycardai-mcp 2.3.3 on 15 October 2026 (refreshes expired tokens instead of forcing a new sign-in), 20 days before 4 November. 2.3.4 to 2.3.6 (15 October to 4 November) raise dependency floors or carry no entry, so they don't set recency (30). Releases in the 90 days from 6 August include keycardai-mcp 2.2.0 (29 August), 2.3.0 (7 September), 2.3.1, 2.3.2 and 2.3.3, and @keycardai/mcp 2.0.1 (16 September) to 2.0.3 (9 October) (20). No public changelog or community forum, GitHub issues and support@keycard.ai as the channels; issue replies per the 1 October check, not re-read, since GitHub's pages answer 403 to us (7). Python and TypeScript SDKs are current (15). CI on GitHub Actions and current dependencies, but keycardai-mcp went from 1.0.0 to 2.0.0 in a day, on 6 and 7 August 2026 (7). 30+20+7+15+7 = 79.)