{ "data": { "a": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:51.905590942Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T18:20:51.905590942Z" } }, "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Stytch Connected Apps's 63.8 (B), and leads in every scored category.", "b": { "slug": "stytch-connected-apps", "name": "Stytch Connected Apps", "vendor": "Stytch (Twilio)", "vendorUrl": "https://stytch.com/connected-apps", "kind": "http-api", "category": "agent-auth", "summary": "Turns a Stytch project into an OAuth 2.1 and OIDC authorisation server so agents and MCP clients can act for your users.", "url": "https://www.anchorterminal.com/tools/stytch-connected-apps", "markdownUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/stytch-connected-apps.json", "dns": "stytch-connected-apps.grade.anchorterminal.com", "repo": "https://github.com/stytchauth/stytch-node", "license": "MIT (SDKs), platform closed", "transports": [ "http" ], "remoteUrl": "https://api.stytch.com", "packages": [ { "registry": "npm", "name": "stytch" }, { "registry": "pypi", "name": "stytch" } ], "auth": "mixed", "authNotes": "Backend calls use HTTP basic auth with the project ID as the user and the secret as the password against api.stytch.com (test.stytch.com for test projects). Agents and MCP clients go through OAuth 2.1: metadata at `{project-domain}/.well-known/oauth-authorization-server`, registration at `/v1/oauth2/register` with no credentials, the token endpoint at `/v1/oauth2/token`, and PKCE with S256 required for public clients. The end user must already have a Stytch session when the consent page loads.", "pricing": "freemium", "pricingNotes": "Pay as you go starts at $0 with 10,000 monthly active users (people and AI agents count the same), unlimited organisations, 5 SSO or SCIM connections and 1,000 M2M tokens a month. Extra SSO or SCIM connections are $125 each, brand removal and full email customisation is a $99 one-off, and fraud fingerprints are $0.005 each after 10,000. Enterprise is custom, with volume discounts, unlimited SSO and SCIM, a 99.99 per cent SLA, a HIPAA BAA and a private Slack channel. Connected Apps has no separate line and bills through MAU (https://stytch.com/pricing, https://stytch.com/connected-apps). The page doesn't state the per-MAU overage price or whether a card is needed.", "priceSummary": "$125 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 116, "npmWeekly": 349007, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://stytch.com/docs/connected-apps/guides/mcp-auth-overview", "llmsTxt": "https://stytch.com/docs/llms.txt", "capabilities": [ "auth.oauth", "auth.consent", "auth.agent-identity", "auth.tokens" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "llms-txt", "typescript", "python", "enterprise" ], "lastRelease": "2026-10-26", "graded": true, "anchor": { "graded": true, "score": 63.8, "grade": "B", "agentReady": false, "rank": 496, "ranked": true, "rankOf": 1486, "categoryRank": 14, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 76, "payments": 20, "reliability": 73, "schema": 64, "security": 76, "transparency": 66 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-03" }, "negative": 0, "verdict": "OAuth 2.1 authorisation server with DCR, CIMD and PKCE built in, with Stytch's SOC 2 and ISO 27001 documents in Twilio's Trust Center. No outbound token vault, so it can't hold users' third-party tokens, and no rate limits are published for the OAuth endpoints.", "bestFor": "A team that needs an OAuth 2.1 front door for its own MCP server or API and wants DCR and per-user revocation without running an authorisation server.", "strengths": [ "OAuth 2.1 authorisation server with DCR, CIMD and PKCE built in", "Revoke an app's access and all its tokens for a user with one API call", "Consent screen built from RBAC roles, so agents only see grantable scopes", "10,000 monthly active users free, agents counted as users", "Stytch's SOC 2 report and ISO 27001 certificate sit in the Twilio Trust Center, and Twilio's bug bounty covers Stytch services" ], "weaknesses": [ "No outbound token vault, so it can't hold your users' third-party tokens", "Python and Go SDKs last tagged 24 June 2026", "No published rate limits for the OAuth, registration or token endpoints", "No audit log of grants and revocations that we could find", "No security.txt on stytch.com" ], "agentNotes": [ "Fetch `{project-domain}/.well-known/oauth-authorization-server` first and use the endpoints it returns, not hard-coded paths", "Register with `token_endpoint_auth_method` none and PKCE S256 when the agent can't keep a secret", "Expect a 401 with protected resource metadata from the MCP server, then register and authorise", "Ask only for scopes the user's roles can grant, or the consent page will refuse them", "Back off exponentially on a 429, since no Retry-After header is documented" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63.8 } ], "editorialScores": { "ergonomics": 65, "maintenance": 76, "payments": 20, "reliability": 73, "schema": 64, "security": 76, "transparency": 42 }, "provenanceScore": 90, "checked": { "categories": { "ergonomics": "2026-11-03", "maintenance": "2026-11-03", "payments": "2026-11-03", "reliability": "2026-11-03", "schema": "2026-11-03", "security": "2026-11-03", "transparency": "2026-11-03" }, "last": "2026-11-03", "lastMoved": "2026-11-03", "oldest": "2026-11-03", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install stytch", "http": "curl -X POST https://api.stytch.com/v1/connected_apps/clients \\\n -u \"$STYTCH_PROJECT_ID:$STYTCH_SECRET\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"client_type\":\"third_party_public\",\"client_name\":\"My agent\",\"redirect_urls\":[\"https://example.com/callback\"]}'" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/stytch-connected-apps" }, "sameCompany": [ "twilio-voice", "sendgrid", "twilio" ], "area": "agent-runtime", "unitPrices": [ { "item": "SSO or SCIM connection above 5", "unit": "month", "usd": 125, "note": "Per connection per month on Pay as you go" }, { "item": "Fraud fingerprint above 10,000", "unit": "call", "usd": 0.005, "note": "Optional fraud add-on" } ], "provenance": { "legalEntity": "Twilio Inc.", "domain": "stytch.com", "domainRegistered": "2014-04-25", "endpointOnVendorDomain": true, "terms": "https://www.twilio.com/en-us/legal/tos", "privacy": "https://www.twilio.com/en-us/legal/privacy", "statusPage": "https://status.stytch.com", "changelog": "https://stytch.com/docs/resources/changelog", "securityTxt": "none", "checked": "2026-11-03", "notes": [ "stytch.com/legal/terms-of-service and /legal/privacy-policy return 302 redirects to twilio.com. Twilio's terms name Twilio Inc., a Delaware corporation, and link to the last Stytch terms at twilio.com/en-us/legal/tos/stytch-tos.", "/.well-known/security.txt returned 404 on 2026-11-03. The docs security page redirects to Twilio's Security Overview, which covers Stytch-branded services.", "status.stytch.com moved from Atlassian Statuspage to Instatus, with RSS and Atom history feeds.", "Dated product entries are at stytch.com/docs/resources/changelog, newest 25 September 2026. stytch.com/docs/changelog now redirects to the React SDK changelog.", "Twilio's sub-processor page lists 13 sub-processors for Stytch by Twilio, updated September 2026." ], "score": 90 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.json", "live": { "slug": "stytch-connected-apps", "probe": { "target": "https://api.stytch.com", "method": "get", "lastAt": "2026-11-07T18:20:57.512091901Z", "lastOk": true, "lastStatus": 404, "lastMs": 478, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 451, "p95ms24h": 565, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 246 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.stytch.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-11-07T04:48:50.272083012Z" }, "versions": [ { "registry": "github", "name": "stytchauth/stytch-node", "version": "v14.3.0", "released": "2026-10-27", "seenAt": "2026-11-07T00:09:12.382708606Z" }, { "registry": "npm", "name": "stytch", "version": "14.3.0", "seenAt": "2026-11-07T00:09:11.359042544Z" }, { "registry": "pypi", "name": "stytch", "version": "15.3.0", "released": "2026-06-24", "seenAt": "2026-11-07T00:09:12.201122696Z" } ], "githubStars": 116, "npmWeekly": 462460, "pypiWeekly": 169768, "securityTxt": { "url": "https://stytch.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:22.781735046Z" }, "llmsTxt": { "url": "https://stytch.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:06.262765407Z" }, "domain": { "domain": "stytch.com", "registered": "2014-04-25", "source": "https://rdap.verisign.com/com/v1/domain/stytch.com", "checkedAt": "2026-11-01T14:25:52.828147631Z" }, "pages": [ { "url": "https://stytch.com/docs/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-04T08:33:53.544632983Z", "changedAt": "2026-10-26T03:25:21.339573905Z", "fingerprint": "6293e18d62c5" }, { "url": "https://stytch.com/docs/resources/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:21:05.991147934Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "44c6bf9acb5b" }, { "url": "https://stytch.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-11-07T14:21:08.576174675Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "61105c9b4a8b" } ], "github": { "repo": "stytchauth/stytch-node", "checkedAt": "2026-11-02T09:28:52.115307497Z", "stars": 116, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-27T03:06:32Z", "openIssues": 3, "openPRs": 5, "issuesOpened90d": 1, "issuesClosed90d": 1, "prsMerged90d": 1, "ci": { "branch": "main", "runs": 50, "success": 31, "failure": 19, "other": 0, "latest": "success", "latestAt": "2026-10-27T03:06:22Z" }, "replies": { "sampled": 25, "unanswered": 3, "medianDays": 23.6 } }, "updatedAt": "2026-11-07T18:20:57.512091901Z" } }, "edges": [ { "by": 30, "category": "payments", "leads": "cloudflare-workers-oauth-provider", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.", "b": "No x402, MPP or L402 (0). Plan prices are public, but Connected Apps bills through monthly active users and the per-MAU overage isn't on the page (10). 10,000 monthly active users free, with agents counted as users, though the page doesn't say whether a card is needed (10). A person signs up in a browser to create a project (0)." }, "scores": { "a": 50, "b": 20 } }, { "by": 22, "category": "schema", "leads": "cloudflare-workers-oauth-provider", "name": "Schema \u0026 documentation", "reasons": { "a": "Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.", "b": "We found no public OpenAPI file, though the authorisation server publishes standard OAuth metadata at `/.well-known/oauth-authorization-server` (10). llms.txt at stytch.com/docs/llms.txt, now an index of Markdown pages (10). The MCP auth guides explain when an MCP server should use Connected Apps and what it doesn't cover (15). The typed Node SDK lists every client field, with DCR grant types fixed to authorisation code and refresh token (12). Worked examples in the guides, but we didn't check the error reference (5). stytch.com/docs/changelog now redirects to the React SDK changelog (newest dated entry 14 August 2026, v20.3.0 undated), and the product changelog at stytch.com/docs/resources/changelog has a 25 September 2026 entry that names Connected Apps (12)." }, "scores": { "a": 86, "b": 64 } }, { "by": 20, "category": "transparency", "leads": "cloudflare-workers-oauth-provider", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.", "b": "Closed platform under Twilio's terms (updated 16 July 2026), with the last Stytch terms kept at an archive link for existing customers (15). Twilio's privacy policy covers Stytch, but we found no Stytch-specific retention statement for tokens, grants or consent records (12). We found no deprecation policy or dated deprecation notices (0). Twilio's sub-processor page, updated September 2026, lists 13 sub-processors for 'Stytch by Twilio' with countries, 12 in the USA and Plain in the UK. Where Stytch's own platform is hosted isn't stated (15 of 20)." }, "scores": { "a": 86, "b": 66 } }, { "by": 11, "category": "maintenance", "leads": "cloudflare-workers-oauth-provider", "name": "Maintenance \u0026 community", "reasons": { "a": "1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.", "b": "The newest release is stytch-node v14.3.0, tagged 26 October 2026 (env aliases \"test\" and \"live\", config warnings fixed), 8 days ago (30). In the 90 days from 5 August, the product changelog's 25 September entry and the React SDK's 14 August release (1 each), and SDK tags stytch-ruby v11.1.1 (15 October), stytch-java 11.4.0 (20 October) and stytch-node v14.3.0 (26 October) at half each, 3.5 in all (20). Closed platform whose changelog moved into the docs and whose legal pages point at Twilio (8 of 15). Node, Ruby and Java were tagged in October; Python (v15.3.0) and Go (v18.1.0) were last tagged on 24 June 2026 (12 of 15). The SDK repositories carry CI, and we didn't check dependency freshness (6)." }, "scores": { "a": 87, "b": 76 } }, { "by": 9, "category": "ergonomics", "leads": "cloudflare-workers-oauth-provider", "name": "Agent ergonomics", "reasons": { "a": "Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.", "b": "Token and metadata responses are small and fixed (20). We didn't confirm pagination on the Connected Apps client list (10). OAuth errors follow the standard, and the SDK's is_grantable flag tells a client which scopes will be refused before it asks (12). Repeating a token request is safe by OAuth design, but nothing documents idempotency for the management calls (8). Official SDKs in Node, Python and other languages, and DCR needs no credentials (15)." }, "scores": { "a": 74, "b": 65 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Cloudflare", "b": "Stytch (Twilio)", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.stytch.com", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "MIT (SDKs), platform closed", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "2026-10-22", "b": "2026-10-26", "name": "Last release" }, { "a": "2025-09-12", "b": "2026-07-16", "name": "Terms last updated" }, { "a": "no date given", "b": "2026-04-09", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "yes", "name": "Arbitration or class-action waiver" }, { "a": "1.9k stars, 1.1M npm/wk", "b": "116 stars, 349k npm/wk", "name": "Popularity" }, { "a": "none", "b": "3/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Stytch Connected Apps's 63.8 (B), and leads in every scored category.", "question": "Which is better for AI agents, Cloudflare Workers OAuth Provider or Stytch Connected Apps?" }, { "answer": "No hosted endpoint is listed for Cloudflare Workers OAuth Provider. Stytch Connected Apps has a hosted endpoint at https://api.stytch.com.", "question": "Can an agent call Cloudflare Workers OAuth Provider and Stytch Connected Apps without installing anything?" }, { "answer": "Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Stytch Connected Apps.", "question": "Are Cloudflare Workers OAuth Provider and Stytch Connected Apps open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 86 against 64", "Agent ergonomics, 74 against 65", "Payments \u0026 pricing, 50 against 20", "Maintenance \u0026 community, 87 against 76", "Transparency \u0026 trust, 86 against 66" ], "also": [ "Agent-ready, a grade of BB or better", "Open source" ], "goodFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "slug": "cloudflare-workers-oauth-provider", "watchFor": "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV" }, { "aheadOn": null, "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "A team that needs an OAuth 2.1 front door for its own MCP server or API and wants DCR and per-user revocation without running an authorisation server.", "slug": "stytch-connected-apps", "watchFor": "No outbound token vault, so it can't hold your users' third-party tokens" } ], "history": { "cloudflare-workers-oauth-provider": null, "stytch-connected-apps": [ { "causes": [ "product", "evidence" ], "date": "2026-11-03", "delta": 3, "from": 60.8, "fromGrade": "C", "to": 63.8, "toGrade": "B" } ] }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json", "title": "Aembit vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps.json", "title": "Aembit vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json", "title": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-stytch-connected-apps.json", "title": "Amazon Bedrock AgentCore Identity vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.json", "title": "Arcade.dev vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json", "title": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.json", "title": "Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json", "title": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json", "title": "Cloudflare Workers OAuth Provider vs Keycard", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json", "title": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json", "title": "Cloudflare Workers OAuth Provider vs Nango", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json", "title": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json", "title": "Cloudflare Workers OAuth Provider vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json", "title": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps.json", "title": "Descope Agentic Identity Hub vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.json", "title": "Keycard vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-stytch-connected-apps.json", "title": "Microsoft Entra Agent ID vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/nango-vs-stytch-connected-apps.json", "title": "Nango vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/nango-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-stytch-connected-apps.json", "title": "Scalekit AgentKit vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect.json", "title": "Stytch Connected Apps vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-workos-pipes.json", "title": "Stytch Connected Apps vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-workos-pipes" } ], "panel": null, "scores": [ { "by": 1, "cloudflare-workers-oauth-provider": 74, "edge": "cloudflare-workers-oauth-provider", "key": "reliability", "name": "Reliability", "stytch-connected-apps": 73, "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 22, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "schema", "name": "Schema \u0026 documentation", "stytch-connected-apps": 64, "weight": 13 }, { "by": 9, "cloudflare-workers-oauth-provider": 74, "edge": "cloudflare-workers-oauth-provider", "key": "ergonomics", "name": "Agent ergonomics", "stytch-connected-apps": 65, "weight": 13 }, { "by": 4, "cloudflare-workers-oauth-provider": 80, "edge": "cloudflare-workers-oauth-provider", "key": "security", "name": "Security \u0026 auth", "stytch-connected-apps": 76, "weight": 14 }, { "by": 30, "cloudflare-workers-oauth-provider": 50, "edge": "cloudflare-workers-oauth-provider", "key": "payments", "name": "Payments \u0026 pricing", "stytch-connected-apps": 20, "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 11, "cloudflare-workers-oauth-provider": 87, "edge": "cloudflare-workers-oauth-provider", "key": "maintenance", "name": "Maintenance \u0026 community", "stytch-connected-apps": 76, "weight": 7 }, { "by": 20, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "transparency", "name": "Transparency \u0026 trust", "stytch-connected-apps": 66, "weight": 7 } ], "summary": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Stytch Connected Apps's 63.8 (B), and leads in every scored category. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "cloudflare-workers-oauth-provider": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "stytch-connected-apps": "OAuth 2.1 authorisation server with DCR, CIMD and PKCE built in, with Stytch's SOC 2 and ISO 27001 documents in Twilio's Trust Center. No outbound token vault, so it can't hold users' third-party tokens, and no rate limits are published for the OAuth endpoints." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps", "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.min.md" }, "markdown": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Stytch Connected Apps's 63.8 (B), and leads in every scored category. Both do oauth for agents.\n\n- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n- Stytch Connected Apps: grade B, 63.8/100, rank #496 of 1486. Markdown https://www.anchorterminal.com/tools/stytch-connected-apps.md · JSON https://www.anchorterminal.com/api/v1/tools/stytch-connected-apps.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Cloudflare Workers OAuth Provider (BB)\n\nGood for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.\n\nAhead on:\n- Schema \u0026 documentation, 86 against 64\n- Agent ergonomics, 74 against 65\n- Payments \u0026 pricing, 50 against 20\n- Maintenance \u0026 community, 87 against 76\n- Transparency \u0026 trust, 86 against 66\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n\nWatch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n\n### Stytch Connected Apps (B)\n\nGood for: A team that needs an OAuth 2.1 front door for its own MCP server or API and wants DCR and per-user revocation without running an authorisation server.\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: No outbound token vault, so it can't hold your users' third-party tokens\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Cloudflare Workers OAuth Provider +30\n\n- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n- Stytch Connected Apps (20): No x402, MPP or L402 (0). Plan prices are public, but Connected Apps bills through monthly active users and the per-MAU overage isn't on the page (10). 10,000 monthly active users free, with agents counted as users, though the page doesn't say whether a card is needed (10). A person signs up in a browser to create a project (0).\n\n### Schema \u0026 documentation: Cloudflare Workers OAuth Provider +22\n\n- Cloudflare Workers OAuth Provider (86): Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.\n- Stytch Connected Apps (64): We found no public OpenAPI file, though the authorisation server publishes standard OAuth metadata at `/.well-known/oauth-authorization-server` (10). llms.txt at stytch.com/docs/llms.txt, now an index of Markdown pages (10). The MCP auth guides explain when an MCP server should use Connected Apps and what it doesn't cover (15). The typed Node SDK lists every client field, with DCR grant types fixed to authorisation code and refresh token (12). Worked examples in the guides, but we didn't check the error reference (5). stytch.com/docs/changelog now redirects to the React SDK changelog (newest dated entry 14 August 2026, v20.3.0 undated), and the product changelog at stytch.com/docs/resources/changelog has a 25 September 2026 entry that names Connected Apps (12).\n\n### Transparency \u0026 trust: Cloudflare Workers OAuth Provider +20\n\n- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.\n- Stytch Connected Apps (66): Closed platform under Twilio's terms (updated 16 July 2026), with the last Stytch terms kept at an archive link for existing customers (15). Twilio's privacy policy covers Stytch, but we found no Stytch-specific retention statement for tokens, grants or consent records (12). We found no deprecation policy or dated deprecation notices (0). Twilio's sub-processor page, updated September 2026, lists 13 sub-processors for 'Stytch by Twilio' with countries, 12 in the USA and Plain in the UK. Where Stytch's own platform is hosted isn't stated (15 of 20).\n\n### Maintenance \u0026 community: Cloudflare Workers OAuth Provider +11\n\n- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.\n- Stytch Connected Apps (76): The newest release is stytch-node v14.3.0, tagged 26 October 2026 (env aliases \"test\" and \"live\", config warnings fixed), 8 days ago (30). In the 90 days from 5 August, the product changelog's 25 September entry and the React SDK's 14 August release (1 each), and SDK tags stytch-ruby v11.1.1 (15 October), stytch-java 11.4.0 (20 October) and stytch-node v14.3.0 (26 October) at half each, 3.5 in all (20). Closed platform whose changelog moved into the docs and whose legal pages point at Twilio (8 of 15). Node, Ruby and Java were tagged in October; Python (v15.3.0) and Go (v18.1.0) were last tagged on 24 June 2026 (12 of 15). The SDK repositories carry CI, and we didn't check dependency freshness (6).\n\n### Agent ergonomics: Cloudflare Workers OAuth Provider +9\n\n- Cloudflare Workers OAuth Provider (74): Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.\n- Stytch Connected Apps (65): Token and metadata responses are small and fixed (20). We didn't confirm pagination on the Connected Apps client list (10). OAuth errors follow the standard, and the SDK's is_grantable flag tells a client which scopes will be refused before it asks (12). Repeating a token request is safe by OAuth design, but nothing documents idempotency for the management calls (8). Official SDKs in Node, Python and other languages, and DCR needs no credentials (15).\n\n## Score by category\n\n| Category | Weight | Cloudflare Workers OAuth Provider | Stytch Connected Apps | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 74 | 73 | Cloudflare Workers OAuth Provider +1 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 86 | 64 | Cloudflare Workers OAuth Provider +22 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 65 | Cloudflare Workers OAuth Provider +9 |\n| Security \u0026 auth | 14% (17.5 this run) | 80 | 76 | Cloudflare Workers OAuth Provider +4 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 20 | Cloudflare Workers OAuth Provider +30 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 87 | 76 | Cloudflare Workers OAuth Provider +11 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 86 | 66 | Cloudflare Workers OAuth Provider +20 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **76.2 · BB** | **63.8 · B** | |\n\n## Facts side by side\n\n| Fact | Cloudflare Workers OAuth Provider | Stytch Connected Apps |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Cloudflare | Stytch (Twilio) |\n| Hosted endpoint | no (local only) | `https://api.stytch.com` |\n| Transports | | HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | MIT (SDKs), platform closed |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| Last release | 2026-10-22 | 2026-10-26 |\n| Terms last updated | 2025-09-12 | 2026-07-16 |\n| Privacy policy last updated | no date given | 2026-04-09 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | yes | yes |\n| Popularity | 1.9k stars, 1.1M npm/wk | 116 stars, 349k npm/wk |\n| Agent reviews | none | 3/5 (2) |\n\n## How the scores have moved\n\n### Cloudflare Workers OAuth Provider\n\nNo score change since it was listed.\n\n### Stytch Connected Apps\n\n- +3.0 on 3 November 2026 (C to B): product, new evidence\n\n## Verdicts\n\n**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n**Stytch Connected Apps.** OAuth 2.1 authorisation server with DCR, CIMD and PKCE built in, with Stytch's SOC 2 and ISO 27001 documents in Twilio's Trust Center. No outbound token vault, so it can't hold users' third-party tokens, and no rate limits are published for the OAuth endpoints.\n\n## Before you call either\n\n### Cloudflare Workers OAuth Provider\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n### Stytch Connected Apps\n\n1. Fetch `{project-domain}/.well-known/oauth-authorization-server` first and use the endpoints it returns, not hard-coded paths\n2. Register with `token_endpoint_auth_method` none and PKCE S256 when the agent can't keep a secret\n3. Expect a 401 with protected resource metadata from the MCP server, then register and authorise\n4. Ask only for scopes the user's roles can grant, or the consent page will refuse them\n5. Back off exponentially on a 429, since no Retry-After header is documented\n\n## Questions\n\n### Which is better for AI agents, Cloudflare Workers OAuth Provider or Stytch Connected Apps?\n\nCloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Stytch Connected Apps's 63.8 (B), and leads in every scored category.\n\n### Can an agent call Cloudflare Workers OAuth Provider and Stytch Connected Apps without installing anything?\n\nNo hosted endpoint is listed for Cloudflare Workers OAuth Provider. Stytch Connected Apps has a hosted endpoint at https://api.stytch.com.\n\n### Are Cloudflare Workers OAuth Provider and Stytch Connected Apps open source?\n\nCloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Stytch Connected Apps.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cloudflare-workers-oauth-provider\", \"b\": \"stytch-connected-apps\"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider stytch-connected-apps`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/stytch-connected-apps.json\n\n## Other comparisons with Cloudflare Workers OAuth Provider or Stytch Connected Apps\n\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)\n- [Aembit vs Stytch Connected Apps](https://www.anchorterminal.com/compare/aembit-vs-stytch-connected-apps.md)\n- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)\n- [Amazon Bedrock AgentCore Identity vs Stytch Connected Apps](https://www.anchorterminal.com/compare/agentcore-identity-vs-stytch-connected-apps.md)\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)\n- [Arcade.dev vs Stytch Connected Apps](https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.md)\n- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)\n- [Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.md)\n- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)\n- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)\n- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)\n- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)\n- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)\n- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)\n- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)\n- [Descope Agentic Identity Hub vs Stytch Connected Apps](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps.md)\n- [Keycard vs Stytch Connected Apps](https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.md)\n- [Microsoft Entra Agent ID vs Stytch Connected Apps](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-stytch-connected-apps.md)\n- [Nango vs Stytch Connected Apps](https://www.anchorterminal.com/compare/nango-vs-stytch-connected-apps.md)\n- [Scalekit AgentKit vs Stytch Connected Apps](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-stytch-connected-apps.md)\n- [Stytch Connected Apps vs Vercel Connect](https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect.md)\n- [Stytch Connected Apps vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/stytch-connected-apps-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "url": "" } ], "description": "Cloudflare Workers OAuth Provider scores 76.2 (BB) to Stytch Connected Apps's 63.8 (B) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cloudflare Workers OAuth Provider BB 76.2", "Stytch Connected Apps B 63.8", "scores" ], "h1": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps", "published": "2026-10-01", "section": "tools", "title": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps" }, "tokens": { "markdown": 4150, "slim": 2080 }, "version": 1 }