Cloudflare Workers OAuth Provider vs Vercel Connect

Cloudflare Workers OAuth Provider 50

Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.

Vercel Connect 40

No x402, MPP or L402 (0). Unit prices are public without a login, re-read on 1 November 2026, $3.00 per 1,000 token requests and $0.95 per 1,000 triggers on Pro, and MCP Events deliveries are billed as triggers (20). Hobby includes 500 token requests and 1,000 triggers a month at no charge, for non-commercial use. The Hobby plan page, read on 17 October, calls the plan free with no billing cycles and asks for card details only when upgrading to Pro (20). A person signs up in a browser, and connectors and user consent also pass through a browser (0).

Cloudflare Workers OAuth Provider 86

MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating resolveExternalToken, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.

Vercel Connect 77

Closed service under the Terms of Service last updated 19 October 2026, with the Connect product terms now in Vercel's Service Terms (last updated 15 October 2026), and an Apache-2.0 SDK and CLI (20). A privacy notice (last updated 1 June 2026) and a DPA exist. The DPA, read on 17 October, is effective 31 March 2026, covers Pro and Enterprise only and has customer data deleted within a commercially reasonable time after termination. The docs say refresh tokens are stored on Vercel's infrastructure and give event retention by plan. We found no retention period or encryption statement for stored provider credentials (18). No deprecation policy found. The Service Terms still let Vercel "add or remove Third Party Platforms to Vercel Connect without notice", though the beta price change was announced with a date of 25 September 2026 (5). The DPA points to a subprocessor list on security.vercel.com and says primary processing is in the United States. We saw the list's page but could not read its entries (12).

Cloudflare Workers OAuth Provider 87

1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.

Vercel Connect 81

@vercel/connect 2.7.0 was published on 31 October 2026, per npm's search API (30). The Vercel changelog has Connect entries on 11 and 25 August, 11, 21, 24 and 29 September, three on 15 October, and on 23, 26 and 29 October 2026 (managed Stripe API keys, service discovery in the CLI, webhook triggers for five more providers) (20). Closed service with a dated public changelog. The public copy of the SDK in vercel/vercel was synced from Vercel's internal repository on 27 October at 2.5.6, behind npm, and we didn't read issue replies (10). One current official SDK (15). One runtime dependency (@vercel/oidc 4.0.5 at 2.7.0) and a test folder in the package. We didn't confirm CI status on the default branch (6).