Cloudflare Workers OAuth Provider vs Stytch Connected Apps

Cloudflare Workers OAuth Provider 50

Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.

Stytch Connected Apps 20

No x402, MPP or L402 (0). Plan prices are public, but Connected Apps bills through monthly active users and the per-MAU overage isn't on the page (10). 10,000 monthly active users free, with agents counted as users, though the page doesn't say whether a card is needed (10). A person signs up in a browser to create a project (0).

Cloudflare Workers OAuth Provider 86

Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as invalid_target and the insufficientScope 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.

Stytch Connected Apps 64

We found no public OpenAPI file, though the authorisation server publishes standard OAuth metadata at /.well-known/oauth-authorization-server (10). llms.txt at stytch.com/docs/llms.txt, now an index of Markdown pages (10). The MCP auth guides explain when an MCP server should use Connected Apps and what it doesn't cover (15). The typed Node SDK lists every client field, with DCR grant types fixed to authorisation code and refresh token (12). Worked examples in the guides, but we didn't check the error reference (5). stytch.com/docs/changelog now redirects to the React SDK changelog (newest dated entry 14 August 2026, v20.3.0 undated), and the product changelog at stytch.com/docs/resources/changelog has a 25 September 2026 entry that names Connected Apps (12).

Cloudflare Workers OAuth Provider 86

MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating resolveExternalToken, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.

Stytch Connected Apps 66

Closed platform under Twilio's terms (updated 16 July 2026), with the last Stytch terms kept at an archive link for existing customers (15). Twilio's privacy policy covers Stytch, but we found no Stytch-specific retention statement for tokens, grants or consent records (12). We found no deprecation policy or dated deprecation notices (0). Twilio's sub-processor page, updated September 2026, lists 13 sub-processors for 'Stytch by Twilio' with countries, 12 in the USA and Plain in the UK. Where Stytch's own platform is hosted isn't stated (15 of 20).

Cloudflare Workers OAuth Provider 87

1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.

Stytch Connected Apps 76

The newest release is stytch-node v14.3.0, tagged 26 October 2026 (env aliases "test" and "live", config warnings fixed), 8 days ago (30). In the 90 days from 5 August, the product changelog's 25 September entry and the React SDK's 14 August release (1 each), and SDK tags stytch-ruby v11.1.1 (15 October), stytch-java 11.4.0 (20 October) and stytch-node v14.3.0 (26 October) at half each, 3.5 in all (20). Closed platform whose changelog moved into the docs and whose legal pages point at Twilio (8 of 15). Node, Ruby and Java were tagged in October; Python (v15.3.0) and Go (v18.1.0) were last tagged on 24 June 2026 (12 of 15). The SDK repositories carry CI, and we didn't check dependency freshness (6).

Cloudflare Workers OAuth Provider 74

Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.

Stytch Connected Apps 65

Token and metadata responses are small and fixed (20). We didn't confirm pagination on the Connected Apps client list (10). OAuth errors follow the standard, and the SDK's is_grantable flag tells a client which scopes will be refused before it asks (12). Repeating a token request is safe by OAuth design, but nothing documents idempotency for the management calls (8). Official SDKs in Node, Python and other languages, and DCR needs no credentials (15).