Cloudflare Workers OAuth Provider vs Nango

Cloudflare Workers OAuth Provider 50

Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.

Nango 40

No x402, MPP or L402 (0). Per-unit prices published without a login, $0.29 per connection a month, $0.72 per compute hour and $0.50 per GB on Pay-as-you-go, re-read on 1 November 2026 (20). Free plan with 10 connections, 10 compute hours and 10 GB a month, and no card per the 1 October check (20). A person signs up in a browser (0).

Cloudflare Workers OAuth Provider 80

OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.

Nango 71

Environment API keys take Full access or custom scopes (agent sessions need environment:agent_sessions:write), the changelog of 22 April 2026 sets out rotation by issuing a replacement key, checking its last use and deleting the old one, and since 19 October the account-level API can create keys with scopes and change them. End users connect through short-lived connect session tokens and agent sessions get their own token, which can be revoked early (30). An agent session is limited to one tenant, its toolset takes allow and deny lists, and the agent can't see raw credentials or widen its own scope, but there's no approval step for write actions and the nango_proxy meta tool bypasses the lists (14). Agent sessions pass third-party API content straight to the agent and we found no prompt-injection guidance (5). Logs for 15 days on every plan, and an audit trail (added 3 September 2026) only on Enterprise (10). security.txt valid to 31 December 2027, SECURITY.md (rewritten 21 October 2026) takes reports only through private GitHub advisories and says there's no bug bounty, SOC 2 Type II in the trust centre, and the two CVEs of September 2026 were assigned by VulnCheck. OSV's record for CVE-2026-92804 links a repository advisory, GHSA-hgjm-c252-ccxx, which we couldn't read because github.com refuses our reader (12). 30 + 14 + 5 + 10 + 12 = 71.

Cloudflare Workers OAuth Provider 86

MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating resolveExternalToken, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.

Nango 77

Source on GitHub under the Elastic License 2.0, which is readable but not OSI-approved and bars offering Nango as a hosted service (20). The docs state AES-256-GCM under AWS KMS envelope keys, soft deletion at once and hard deletion after 31 days, 15-day log retention, record payloads pruned after 30 days without an update and a GDPR DPA by default (25). Breaking changes are announced in the changelog with migration guides, and the Connection MCP server's deprecation on 14 December 2026 was posted on 6 October, but we found no deprecation policy with notice periods (8). The docs say tokens sit in PostgreSQL in AWS, but we didn't find a public subprocessor list outside the trust centre (10).