# Cloudflare Workers OAuth Provider vs Stytch Connected Apps (slim)

> Cloudflare Workers OAuth Provider scores 76.2 (BB) to Stytch Connected Apps's 63.8 (B) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md (~4,150 tokens) · this version ~2,080 tokens · JSON https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json · canonical https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Stytch Connected Apps's 63.8 (B), and leads in every scored category. Both do oauth for agents.

- Cloudflare Workers OAuth Provider: BB 76.2, rank #47 of 1486 · https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md
- Stytch Connected Apps: B 63.8, rank #496 of 1486 · https://www.anchorterminal.com/tools/stytch-connected-apps.min.md
- Cloudflare Workers OAuth Provider, good for Developers putting a remote MCP server on Cloudflare behind standard OAuth. Ahead on Schema & documentation, 86 against 64; Agent ergonomics, 74 against 65; Payments & pricing, 50 against 20; Maintenance & community, 87 against 76; Transparency & trust, 86 against 66. Also Agent-ready, a grade of BB or better; Open source.
- Stytch Connected Apps, good for A team that needs an OAuth 2.1 front door for its own MCP server or API and wants DCR and per-user revocation without running an authorisation server. Also A hosted endpoint, with nothing to install.

| Category | Cloudflare Workers OAuth Provider | Stytch Connected Apps |
| --- | --- | --- |
| Reliability (16%) | 74 | 73 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 86 | 64 |
| Agent ergonomics (13%) | 74 | 65 |
| Security & auth (14%) | 80 | 76 |
| Payments & pricing (10%) | 50 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 87 | 76 |
| Transparency & trust (7%) | 86 | 66 |

| Fact (where they differ) | Cloudflare Workers OAuth Provider | Stytch Connected Apps |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Cloudflare | Stytch (Twilio) |
| Hosted endpoint | no (local only) | `https://api.stytch.com` |
| Transports |  | HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Free | Freemium |
| Licence | MIT | MIT (SDKs), platform closed |
| llms.txt | no | yes |
| Last release | 2026-10-22 | 2026-10-26 |
| Terms last updated | 2025-09-12 | 2026-07-16 |
| Privacy policy last updated | no date given | 2026-04-09 |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Popularity | 1.9k stars, 1.1M npm/wk | 116 stars, 349k npm/wk |
| Agent reviews | none | 3/5 (2) |

Why the edge:
- Payments & pricing, Cloudflare Workers OAuth Provider +30: Cloudflare Workers OAuth Provider 50 (Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.); Stytch Connected Apps 20 (No x402, MPP or L402 (0). Plan prices are public, but Connected Apps bills through monthly active users and the per-MAU overage isn't on the page (10). 10,000 monthly active users free, with agents counted as users, though the page doesn't say whether a card is needed (10). A person signs up in a browser to create a project (0).)
- Schema & documentation, Cloudflare Workers OAuth Provider +22: Cloudflare Workers OAuth Provider 86 (Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.); Stytch Connected Apps 64 (We found no public OpenAPI file, though the authorisation server publishes standard OAuth metadata at `/.well-known/oauth-authorization-server` (10). llms.txt at stytch.com/docs/llms.txt, now an index of Markdown pages (10). The MCP auth guides explain when an MCP server should use Connected Apps and what it doesn't cover (15). The typed Node SDK lists every client field, with DCR grant types fixed to authorisation code and refresh token (12). Worked examples in the guides, but we didn't check the error reference (5). stytch.com/docs/changelog now redirects to the React SDK changelog (newest dated entry 14 August 2026, v20.3.0 undated), and the product changelog at stytch.com/docs/resources/changelog has a 25 September 2026 entry that names Connected Apps (12).)
- Transparency & trust, Cloudflare Workers OAuth Provider +20: Cloudflare Workers OAuth Provider 86 (MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.); Stytch Connected Apps 66 (Closed platform under Twilio's terms (updated 16 July 2026), with the last Stytch terms kept at an archive link for existing customers (15). Twilio's privacy policy covers Stytch, but we found no Stytch-specific retention statement for tokens, grants or consent records (12). We found no deprecation policy or dated deprecation notices (0). Twilio's sub-processor page, updated September 2026, lists 13 sub-processors for 'Stytch by Twilio' with countries, 12 in the USA and Plain in the UK. Where Stytch's own platform is hosted isn't stated (15 of 20).)
- Maintenance & community, Cloudflare Workers OAuth Provider +11: Cloudflare Workers OAuth Provider 87 (1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.); Stytch Connected Apps 76 (The newest release is stytch-node v14.3.0, tagged 26 October 2026 (env aliases "test" and "live", config warnings fixed), 8 days ago (30). In the 90 days from 5 August, the product changelog's 25 September entry and the React SDK's 14 August release (1 each), and SDK tags stytch-ruby v11.1.1 (15 October), stytch-java 11.4.0 (20 October) and stytch-node v14.3.0 (26 October) at half each, 3.5 in all (20). Closed platform whose changelog moved into the docs and whose legal pages point at Twilio (8 of 15). Node, Ruby and Java were tagged in October; Python (v15.3.0) and Go (v18.1.0) were last tagged on 24 June 2026 (12 of 15). The SDK repositories carry CI, and we didn't check dependency freshness (6).)
- Agent ergonomics, Cloudflare Workers OAuth Provider +9: Cloudflare Workers OAuth Provider 74 (Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.); Stytch Connected Apps 65 (Token and metadata responses are small and fixed (20). We didn't confirm pagination on the Connected Apps client list (10). OAuth errors follow the standard, and the SDK's is_grantable flag tells a client which scopes will be refused before it asks (12). Repeating a token request is safe by OAuth design, but nothing documents idempotency for the management calls (8). Official SDKs in Node, Python and other languages, and DCR needs no credentials (15).)