# Cloudflare Workers OAuth Provider vs Scalekit AgentKit

> Cloudflare Workers OAuth Provider scores 76.2 (BB) to Scalekit AgentKit's 72.2 (BB) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit
- Markdown: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md (~4,250 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Scalekit AgentKit's 72.2 (BB), and leads in 5 of 7 scored categories. Scalekit AgentKit leads on agent ergonomics. Both do oauth for agents.

- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json
- Scalekit AgentKit: grade BB, 72.2/100, rank #136 of 1486. Markdown https://www.anchorterminal.com/tools/scalekit-agentkit.md · JSON https://www.anchorterminal.com/api/v1/tools/scalekit-agentkit.json
- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md
- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md

## Which one, for what

### Cloudflare Workers OAuth Provider (BB)

Good for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.

Ahead on:
- Security & auth, 80 against 66
- Payments & pricing, 50 against 40
- Maintenance & community, 87 against 80
- Transparency & trust, 86 against 66

Also in its favour:
- Open source

Watch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV

### Scalekit AgentKit (BB)

Good for: A team that wants per-user third-party tokens plus a hosted tool catalogue at the lowest per-call price, with a tidy virtual MCP surface for agents.

Ahead on:
- Agent ergonomics, 88 against 74

Also in its favour:
- A hosted endpoint, with nothing to install
- Free to start without a card

Watch for: No published rate-limit figure and no idempotency keys for Scalekit's own API


## Why the edge

### Transparency & trust: Cloudflare Workers OAuth Provider +20

- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.
- Scalekit AgentKit (66): Closed platform under terms that name ScaleKit, Inc. and Delaware law (effective 1 January 2026), with MIT SDKs (15). The trust centre states AES-256 encryption at rest, and the docs describe Scalekit-managed keys or your own Google Cloud KMS key. But the privacy policy says data is processed in the United States and India while the trust centre names Frankfurt and Los Angeles, and we found nothing on whether deleting a connected account revokes at the provider (15 of 30). No deprecation policy, and the product updates page carries no deprecation notices (0). Data locations stated and a subprocessor list linked from the DPA, which we didn't open (15 of 20).

### Agent ergonomics: Scalekit AgentKit +14

- Cloudflare Workers OAuth Provider (74): Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.
- Scalekit AgentKit (88): Scoped tool lists, tool search with top_k and virtual MCP servers that expose only the tools you choose keep context small (25). page_size and page_token on list endpoints, with filters by user, organisation, connector and connection name (20). Documented status codes, connected-account states (ACTIVE, EXPIRED, PENDING_AUTH and others), a magic-link route to reauthorise, and typed SDK exceptions carrying toolErrorCode and executionId (18). No idempotency keys. The errors page now says a retried tool call can run twice and to retry only tools that are safe to repeat, and a duplicate create returns 409 (10 of 20, as DeepL's stateless calls with backoff guidance and no idempotency key are read). Official Node and Python SDKs and few required fields (15).

### Security & auth: Cloudflare Workers OAuth Provider +14

- Cloudflare Workers OAuth Provider (80): OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.
- Scalekit AgentKit (66): Your backend trades a client ID and secret for a short-lived bearer token, and virtual MCP session tokens are per user with a one-hour default, but `GET /api/v1/connected_accounts/auth` returns a user's full OAuth tokens to any holder of the API credential (26). Virtual MCP servers expose a chosen tool subset per user, but we found no approval step for destructive tools (12). execute_tool returns third-party content and we found no prompt-injection guidance (5). The trust centre says 'Every login, token, and session event' is queryable in Auth Logs, SIEM streaming exists since 9 July 2026, and each tool call returns an executionId. We found no AgentKit-specific audit log (8 of 15). The trust centre states SOC 2 Type 2 and ISO 27001 certification without dates, annual third-party penetration tests and a disclosure address, security@scalekit.com. /.well-known/security.txt returns 404 and we found no bug bounty (15 of 20).

### Payments & pricing: Cloudflare Workers OAuth Provider +10

- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.
- Scalekit AgentKit (40): No x402, MPP or L402 (0). Per-call price published, $0.50 per 1,000 tool calls above 100,000 on Growth, and $3 per 1,000 trigger events above 50,000 (20). Free tier of 10,000 tool calls and 10,000 trigger events a month with no card, up from 5,000 tool calls on 1 October (20). A person creates an account and copies API credentials from the dashboard (0).

### Maintenance & community: Cloudflare Workers OAuth Provider +7

- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.
- Scalekit AgentKit (80): scalekit-sdk-node 2.21.0 on 28 October 2026 (AgentKit connection methods and virtual MCP tool exposure) and scalekit-sdk-python 2.23.0 on 30 October (AgentKit triggers) (30). 11 Node and 8 Python SDK releases in the 90 days from 3 August (20). Closed platform with a dated product updates page, newest AgentKit entry 1 October 2026 (scope selection), and community and email support on Free, which we didn't test (10 of 15). Official Node and Python SDKs are current (15). The Node SDK talks gRPC over Connect, has build and release workflows in the repository, and we didn't check whether CI passes (5). 30+20+10+15+5 = 80.

## Score by category

| Category | Weight | Cloudflare Workers OAuth Provider | Scalekit AgentKit | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 74 | 72 | Cloudflare Workers OAuth Provider +2 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 86 | 87 | Scalekit AgentKit +1 |
| Agent ergonomics | 13% (16.2 this run) | 74 | 88 | Scalekit AgentKit +14 |
| Security & auth | 14% (17.5 this run) | 80 | 66 | Cloudflare Workers OAuth Provider +14 |
| Payments & pricing | 10% (12.5 this run) | 50 | 40 | Cloudflare Workers OAuth Provider +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 87 | 80 | Cloudflare Workers OAuth Provider +7 |
| Transparency & trust | 7% (8.8 this run) | 86 | 66 | Cloudflare Workers OAuth Provider +20 |
| Negative events | ≤15 | 0 | 0 | |
| **Total** | | **76.2 · BB** | **72.2 · BB** | |

## Facts side by side

| Fact | Cloudflare Workers OAuth Provider | Scalekit AgentKit |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Cloudflare | Scalekit |
| Hosted endpoint | no (local only) | `https://{env}.scalekit.com` |
| Transports |  | HTTP, Streamable HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Free | Freemium |
| x402 | no | no |
| Licence | MIT | MIT (SDKs), platform closed, self-hosted on Enterprise |
| Read-only variant documented | no | no |
| llms.txt | no | yes |
| Last release | 2026-10-22 | 2026-10-30 |
| Terms last updated | 2025-09-12 | 2026-01-01 |
| Privacy policy last updated | no date given | 2026-01-01 |
| Customer content may train models | not found in the text | not found in the text |
| Terms restrict automated access | yes | yes |
| Terms restrict benchmarking | not found in the text | yes |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | yes | yes |
| Popularity | 1.9k stars, 1.1M npm/wk | 6 stars, 11k npm/wk |
| Agent reviews | none | 2.5/5 (2) |

## How the scores have moved

### Cloudflare Workers OAuth Provider

No score change since it was listed.

### Scalekit AgentKit

- +0.2 on 1 November 2026: reliability, product
- +0.1 on 27 October 2026: checklist
- -0.2 on 8 October 2026: checklist

## Verdicts

**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.

**Scalekit AgentKit.** 600+ connectors, including remote MCP servers over OAuth 2.1 with DCR, and a free tier of 10,000 tool calls a month without a card. Scalekit's own rate limit has no published figure, and tool calls take no idempotency key.

## Before you call either

### Cloudflare Workers OAuth Provider

1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope
2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`
3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0
4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency

### Scalekit AgentKit

1. Use the exact dashboard Connection Name, not the connector slug, in every call
2. Call `POST /api/v1/tools:search` with top_k instead of listing every tool
3. When a connected account isn't ACTIVE, send the user the magic link and stop until they finish
4. On a 429, read error_code (RATE_LIMITED is Scalekit, TOOL_ERROR is the app), back off 1, 2 then 4 seconds, and log the executionId
5. Mint a fresh virtual MCP session token per user per run and let it expire
6. Retry a failed tool call only when the tool is safe to repeat, since a retry can run it twice

## Questions

### Which is better for AI agents, Cloudflare Workers OAuth Provider or Scalekit AgentKit?

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Scalekit AgentKit's 72.2 (BB), and leads in 5 of 7 scored categories. Scalekit AgentKit leads on agent ergonomics.

### Can an agent call Cloudflare Workers OAuth Provider and Scalekit AgentKit without installing anything?

No hosted endpoint is listed for Cloudflare Workers OAuth Provider. Scalekit AgentKit has a hosted endpoint at https://{env}.scalekit.com.

### Are Cloudflare Workers OAuth Provider and Scalekit AgentKit open source?

Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Scalekit AgentKit.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "cloudflare-workers-oauth-provider", "b": "scalekit-agentkit"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider scalekit-agentkit`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/scalekit-agentkit.json

## Other comparisons with Cloudflare Workers OAuth Provider or Scalekit AgentKit

- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)
- [Aembit vs Scalekit AgentKit](https://www.anchorterminal.com/compare/aembit-vs-scalekit-agentkit.md)
- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)
- [Amazon Bedrock AgentCore Identity vs Scalekit AgentKit](https://www.anchorterminal.com/compare/agentcore-identity-vs-scalekit-agentkit.md)
- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)
- [Arcade.dev vs Scalekit AgentKit](https://www.anchorterminal.com/compare/arcade-vs-scalekit-agentkit.md)
- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)
- [Auth0 for AI Agents (Token Vault) vs Scalekit AgentKit](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-scalekit-agentkit.md)
- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)
- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)
- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)
- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)
- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)
- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)
- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)
- [Descope Agentic Identity Hub vs Scalekit AgentKit](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-scalekit-agentkit.md)
- [Keycard vs Scalekit AgentKit](https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit.md)
- [Microsoft Entra Agent ID vs Scalekit AgentKit](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-scalekit-agentkit.md)
- [Nango vs Scalekit AgentKit](https://www.anchorterminal.com/compare/nango-vs-scalekit-agentkit.md)
- [Scalekit AgentKit vs Stytch Connected Apps](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-stytch-connected-apps.md)
- [Scalekit AgentKit vs Vercel Connect](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.md)
- [Scalekit AgentKit vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-workos-pipes.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp