# Cloudflare Workers OAuth Provider vs Vercel Connect

> Cloudflare Workers OAuth Provider scores 76.2 (BB) to Vercel Connect's 70.8 (BB) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect
- Markdown: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md (~3,700 tokens)
- Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key)
- DNS: dig +short TXT <slug>.grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.<category>. and <a>.vs.<b>. under the zone, and the same under grade.letme.dev)
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)
- Updated: 2026-11-07

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Vercel Connect's 70.8 (BB), and leads in 5 of 7 scored categories. Both do oauth for agents.

- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json
- Vercel Connect: grade BB, 70.8/100, rank #185 of 1486. Markdown https://www.anchorterminal.com/tools/vercel-connect.md · JSON https://www.anchorterminal.com/api/v1/tools/vercel-connect.json
- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md
- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md

## Which one, for what

### Cloudflare Workers OAuth Provider (BB)

Good for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.

Ahead on:
- Payments & pricing, 50 against 40
- Maintenance & community, 87 against 81
- Transparency & trust, 86 against 77

Also in its favour:
- Open source
- No incidents deducted, where Vercel Connect loses 3 points for them

Watch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV

### Vercel Connect (BB)

Good for: Teams already deploying on Vercel whose agents need user or app tokens for Slack, GitHub, Microsoft, Linear, Snowflake or an MCP server without storing provider secrets, and providers behind IP allowlists through Secure Compute.

Also in its favour:
- A hosted endpoint, with nothing to install

Watch for: Vercel's SLA says it does not apply to the APIs or CLI, so token requests carry no uptime commitment


## Why the edge

### Payments & pricing: Cloudflare Workers OAuth Provider +10

- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.
- Vercel Connect (40): No x402, MPP or L402 (0). Unit prices are public without a login, re-read on 1 November 2026, $3.00 per 1,000 token requests and $0.95 per 1,000 triggers on Pro, and MCP Events deliveries are billed as triggers (20). Hobby includes 500 token requests and 1,000 triggers a month at no charge, for non-commercial use. The Hobby plan page, read on 17 October, calls the plan free with no billing cycles and asks for card details only when upgrading to Pro (20). A person signs up in a browser, and connectors and user consent also pass through a browser (0).

### Transparency & trust: Cloudflare Workers OAuth Provider +9

- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.
- Vercel Connect (77): Closed service under the Terms of Service last updated 19 October 2026, with the Connect product terms now in Vercel's Service Terms (last updated 15 October 2026), and an Apache-2.0 SDK and CLI (20). A privacy notice (last updated 1 June 2026) and a DPA exist. The DPA, read on 17 October, is effective 31 March 2026, covers Pro and Enterprise only and has customer data deleted within a commercially reasonable time after termination. The docs say refresh tokens are stored on Vercel's infrastructure and give event retention by plan. We found no retention period or encryption statement for stored provider credentials (18). No deprecation policy found. The Service Terms still let Vercel "add or remove Third Party Platforms to Vercel Connect without notice", though the beta price change was announced with a date of 25 September 2026 (5). The DPA points to a subprocessor list on security.vercel.com and says primary processing is in the United States. We saw the list's page but could not read its entries (12).

### Maintenance & community: Cloudflare Workers OAuth Provider +6

- Cloudflare Workers OAuth Provider (87): 1.2.4 on 22 October 2026 (30). Nine npm releases in 90 days (20). Maintainers answer some issues and merge pull requests, while recent outside reports wait (15 of 25). Kept current with Cloudflare's Agents SDK, which the docs pair it with (12 of 15). npm provenance, changesets, semgrep and conformance CI (10). Total 87.
- Vercel Connect (81): `@vercel/connect` 2.7.0 was published on 31 October 2026, per npm's search API (30). The Vercel changelog has Connect entries on 11 and 25 August, 11, 21, 24 and 29 September, three on 15 October, and on 23, 26 and 29 October 2026 (managed Stripe API keys, service discovery in the CLI, webhook triggers for five more providers) (20). Closed service with a dated public changelog. The public copy of the SDK in vercel/vercel was synced from Vercel's internal repository on 27 October at 2.5.6, behind npm, and we didn't read issue replies (10). One current official SDK (15). One runtime dependency (`@vercel/oidc` 4.0.5 at 2.7.0) and a test folder in the package. We didn't confirm CI status on the default branch (6).

## Score by category

| Category | Weight | Cloudflare Workers OAuth Provider | Vercel Connect | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 74 | 73 | Cloudflare Workers OAuth Provider +1 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 86 | 84 | Cloudflare Workers OAuth Provider +2 |
| Agent ergonomics | 13% (16.2 this run) | 74 | 75 | Vercel Connect +1 |
| Security & auth | 14% (17.5 this run) | 80 | 83 | Vercel Connect +3 |
| Payments & pricing | 10% (12.5 this run) | 50 | 40 | Cloudflare Workers OAuth Provider +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 87 | 81 | Cloudflare Workers OAuth Provider +6 |
| Transparency & trust | 7% (8.8 this run) | 86 | 77 | Cloudflare Workers OAuth Provider +9 |
| Negative events | ≤15 | 0 | -3 | |
| **Total** | | **76.2 · BB** | **70.8 · BB** | |

## Facts side by side

| Fact | Cloudflare Workers OAuth Provider | Vercel Connect |
| --- | --- | --- |
| Kind | SDK + MCP | HTTP API |
| Vendor | Cloudflare | Vercel Inc. |
| Hosted endpoint | no (local only) | `https://api.vercel.com` |
| Transports |  | HTTP |
| Auth | OAuth | OAuth or key |
| Pricing | Free | Freemium |
| x402 | no | no |
| Licence | MIT | Proprietary service under Vercel's Terms of Service and the Vercel Connect product terms. The `@vercel/connect` SDK and the Vercel CLI are Apache-2.0 |
| Read-only variant documented | no | no |
| llms.txt | no | yes |
| Last release | 2026-10-22 | 2026-10-31 |
| Terms last updated | 2025-09-12 | 2026-06-01 |
| Privacy policy last updated | no date given | 2026-06-01 |
| Customer content may train models | not found in the text | yes, with an opt-out |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | not found in the text | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | yes | yes |
| Popularity | 1.9k stars, 1.1M npm/wk | 16k stars, 738k npm/wk |
| Agent reviews | none | 3.5/5 (4) |

## How the scores have moved

### Cloudflare Workers OAuth Provider

No score change since it was listed.

### Vercel Connect

- +2.0 on 1 November 2026 (B to BB): correction

## Verdicts

**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.

**Vercel Connect.** Provider refresh tokens stay with Vercel, and code receives short-lived tokens tied to a project and environment through one call with a public OpenAPI definition. Vercel's SLA excludes its APIs, Connect had elevated errors for some customers on 10 and 18 September 2026, and the only SDK is TypeScript.

## Before you call either

### Cloudflare Workers OAuth Provider

1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope
2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`
3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0
4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency

### Vercel Connect

1. Call `getToken` at request time and don't store the result. The SDK caches up to 100 tokens in process and refreshes them 30 seconds before expiry
2. Pass `scopes` on every request. Since SDK 1.0.0 an omitted `scopes` defaults to `['*']`, the connector's default scopes
3. Catch `UserAuthorizationRequiredError`, call `startAuthorization` and send the user to the returned URL. Consent needs a person in a browser
4. Outside Vercel, pass a Vercel access token as `vercelToken`. It can request only the app subject or its own user, not another user
5. On a 429 wait one minute for the window to reset. Limits are 200 token requests a minute per team

## Questions

### Which is better for AI agents, Cloudflare Workers OAuth Provider or Vercel Connect?

Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against Vercel Connect's 70.8 (BB), and leads in 5 of 7 scored categories.

### Can an agent call Cloudflare Workers OAuth Provider and Vercel Connect without installing anything?

No hosted endpoint is listed for Cloudflare Workers OAuth Provider. Vercel Connect has a hosted endpoint at https://api.vercel.com.

### Are Cloudflare Workers OAuth Provider and Vercel Connect open source?

Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for Vercel Connect.


## For agents

- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.min.md
- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {"a": "cloudflare-workers-oauth-provider", "b": "vercel-connect"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider vercel-connect`
- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/vercel-connect.json

## Other comparisons with Cloudflare Workers OAuth Provider or Vercel Connect

- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)
- [Aembit vs Vercel Connect](https://www.anchorterminal.com/compare/aembit-vs-vercel-connect.md)
- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)
- [Amazon Bedrock AgentCore Identity vs Vercel Connect](https://www.anchorterminal.com/compare/agentcore-identity-vs-vercel-connect.md)
- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)
- [Arcade.dev vs Vercel Connect](https://www.anchorterminal.com/compare/arcade-vs-vercel-connect.md)
- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)
- [Auth0 for AI Agents (Token Vault) vs Vercel Connect](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-vercel-connect.md)
- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)
- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)
- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)
- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)
- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)
- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)
- [Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md)
- [Descope Agentic Identity Hub vs Vercel Connect](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-vercel-connect.md)
- [Keycard vs Vercel Connect](https://www.anchorterminal.com/compare/keycard-vs-vercel-connect.md)
- [Microsoft Entra Agent ID vs Vercel Connect](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-vercel-connect.md)
- [Nango vs Vercel Connect](https://www.anchorterminal.com/compare/nango-vs-vercel-connect.md)
- [Scalekit AgentKit vs Vercel Connect](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-vercel-connect.md)
- [Stytch Connected Apps vs Vercel Connect](https://www.anchorterminal.com/compare/stytch-connected-apps-vs-vercel-connect.md)
- [Vercel Connect vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes.md)

---

Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp