# Cloudflare Workers OAuth Provider vs Nango

> Cloudflare Workers OAuth Provider scores 76.2 (BB) to Nango's 65.5 (B) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango
- Markdown: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md (~3,600 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Nango's 65.5 (B), and leads in 4 of 7 scored categories. Both do oauth for agents.

- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json
- Nango: grade B, 65.5/100, rank #418 of 1486. Markdown https://www.anchorterminal.com/tools/nango.md · JSON https://www.anchorterminal.com/api/v1/tools/nango.json
- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md
- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md

## Which one, for what

### Cloudflare Workers OAuth Provider (BB)

Good for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.

Ahead on:
- Security & auth, 80 against 71
- Payments & pricing, 50 against 40
- Transparency & trust, 86 against 77

Also in its favour:
- Agent-ready, a grade of BB or better
- Open source
- No incidents deducted, where Nango loses 8 points for them

Watch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV

### Nango (B)

Good for: A product that connects many users to many SaaS APIs and wants tokens, refresh, syncs and a per-tenant MCP surface in one place, with source you can read.

Also in its favour:
- A hosted endpoint, with nothing to install

Watch for: Audit trail only on Enterprise, and logs kept 15 days on every plan


## Why the edge

### Payments & pricing: Cloudflare Workers OAuth Provider +10

- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.
- Nango (40): No x402, MPP or L402 (0). Per-unit prices published without a login, $0.29 per connection a month, $0.72 per compute hour and $0.50 per GB on Pay-as-you-go, re-read on 1 November 2026 (20). Free plan with 10 connections, 10 compute hours and 10 GB a month, and no card per the 1 October check (20). A person signs up in a browser (0).

### Security & auth: Cloudflare Workers OAuth Provider +9

- Cloudflare Workers OAuth Provider (80): OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.
- Nango (71): Environment API keys take Full access or custom scopes (agent sessions need `environment:agent_sessions:write`), the changelog of 22 April 2026 sets out rotation by issuing a replacement key, checking its last use and deleting the old one, and since 19 October the account-level API can create keys with scopes and change them. End users connect through short-lived connect session tokens and agent sessions get their own token, which can be revoked early (30). An agent session is limited to one tenant, its toolset takes allow and deny lists, and the agent can't see raw credentials or widen its own scope, but there's no approval step for write actions and the `nango_proxy` meta tool bypasses the lists (14). Agent sessions pass third-party API content straight to the agent and we found no prompt-injection guidance (5). Logs for 15 days on every plan, and an audit trail (added 3 September 2026) only on Enterprise (10). security.txt valid to 31 December 2027, SECURITY.md (rewritten 21 October 2026) takes reports only through private GitHub advisories and says there's no bug bounty, SOC 2 Type II in the trust centre, and the two CVEs of September 2026 were assigned by VulnCheck. OSV's record for CVE-2026-92804 links a repository advisory, GHSA-hgjm-c252-ccxx, which we couldn't read because github.com refuses our reader (12). 30 + 14 + 5 + 10 + 12 = 71.

### Transparency & trust: Cloudflare Workers OAuth Provider +9

- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.
- Nango (77): Source on GitHub under the Elastic License 2.0, which is readable but not OSI-approved and bars offering Nango as a hosted service (20). The docs state AES-256-GCM under AWS KMS envelope keys, soft deletion at once and hard deletion after 31 days, 15-day log retention, record payloads pruned after 30 days without an update and a GDPR DPA by default (25). Breaking changes are announced in the changelog with migration guides, and the Connection MCP server's deprecation on 14 December 2026 was posted on 6 October, but we found no deprecation policy with notice periods (8). The docs say tokens sit in PostgreSQL in AWS, but we didn't find a public subprocessor list outside the trust centre (10).

## Score by category

| Category | Weight | Cloudflare Workers OAuth Provider | Nango | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 74 | 78 | Nango +4 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 86 | 85 | Cloudflare Workers OAuth Provider +1 |
| Agent ergonomics | 13% (16.2 this run) | 74 | 74 | even |
| Security & auth | 14% (17.5 this run) | 80 | 71 | Cloudflare Workers OAuth Provider +9 |
| Payments & pricing | 10% (12.5 this run) | 50 | 40 | Cloudflare Workers OAuth Provider +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 87 | 90 | Nango +3 |
| Transparency & trust | 7% (8.8 this run) | 86 | 77 | Cloudflare Workers OAuth Provider +9 |
| Negative events | ≤15 | 0 | -8 | |
| **Total** | | **76.2 · BB** | **65.5 · B** | |

## Facts side by side

| Fact | Cloudflare Workers OAuth Provider | Nango |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Cloudflare | Nango |
| Hosted endpoint | no (local only) | `https://api.nango.dev` |
| Transports |  | HTTP, Streamable HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Free | Freemium |
| x402 | no | no |
| Licence | MIT | Elastic License 2.0 |
| Read-only variant documented | no | no |
| llms.txt | no | yes |
| Last release | 2026-10-22 | 2026-10-29 |
| Terms last updated | 2025-09-12 | no date given |
| Privacy policy last updated | no date given | no date given |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | yes | yes |
| Arbitration or class-action waiver | yes | yes |
| Popularity | 1.9k stars, 1.1M npm/wk | 469k npm/wk |
| Agent reviews | none | 3.5/5 (2) |

## How the scores have moved

### Cloudflare Workers OAuth Provider

No score change since it was listed.

### Nango

- -2.3 on 1 November 2026: correction, negative event
- +0.1 on 27 October 2026: checklist
- -0.2 on 8 October 2026: checklist

## Verdicts

**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.

**Nango.** Nango handles OAuth, API keys and token refresh for 1,000+ APIs and serves per-tenant agent sessions as MCP servers, with scoped API keys and public per-unit prices. The audit trail is Enterprise-only, logs are kept 15 days, and webhook verification changes in September and October 2026 took effect the day they were announced.

## Before you call either

### Cloudflare Workers OAuth Provider

1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope
2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`
3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0
4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency

### Nango

1. Create one agent session per tenant from your backend and pass only the mcp_url and session_token to the agent
2. Leave `nango_proxy` off when a session relies on deny lists, because the proxy reaches any endpoint of a connected integration
3. Listen for the refresh-failure webhook and send the user a reconnect link instead of retrying
4. Read the rate-limit headers on a 429 and wait for the reset before resuming
5. Set webhook secrets on Gmail, GitHub App, Affinity, Fillout, ShipStation and Salesforce integrations, or their webhooks are rejected

## Questions

### Which is better for AI agents, Cloudflare Workers OAuth Provider or Nango?

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Nango's 65.5 (B), and leads in 4 of 7 scored categories.

### Can an agent call Cloudflare Workers OAuth Provider and Nango without installing anything?

No hosted endpoint is listed for Cloudflare Workers OAuth Provider. Nango has a hosted endpoint at https://api.nango.dev.

### Are Cloudflare Workers OAuth Provider and Nango open source?

Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Nango.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "cloudflare-workers-oauth-provider", "b": "nango"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider nango`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/nango.json

## Other comparisons with Cloudflare Workers OAuth Provider or Nango

- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)
- [Aembit vs Nango](https://www.anchorterminal.com/compare/aembit-vs-nango.md)
- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)
- [Amazon Bedrock AgentCore Identity vs Nango](https://www.anchorterminal.com/compare/agentcore-identity-vs-nango.md)
- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)
- [Arcade.dev vs Nango](https://www.anchorterminal.com/compare/arcade-vs-nango.md)
- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)
- [Auth0 for AI Agents (Token Vault) vs Nango](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango.md)
- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)
- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)
- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)
- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)
- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)
- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)
- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)
- [Descope Agentic Identity Hub vs Nango](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-nango.md)
- [Keycard vs Nango](https://www.anchorterminal.com/compare/keycard-vs-nango.md)
- [Microsoft Entra Agent ID vs Nango](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-nango.md)
- [Nango vs Scalekit AgentKit](https://www.anchorterminal.com/compare/nango-vs-scalekit-agentkit.md)
- [Nango vs Stytch Connected Apps](https://www.anchorterminal.com/compare/nango-vs-stytch-connected-apps.md)
- [Nango vs Vercel Connect](https://www.anchorterminal.com/compare/nango-vs-vercel-connect.md)
- [Nango vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/nango-vs-workos-pipes.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp