{ "data": { "a": { "slug": "cloudflare-workers-oauth-provider", "name": "Cloudflare Workers OAuth Provider", "vendor": "Cloudflare", "vendorUrl": "https://developers.cloudflare.com/agents/model-context-protocol/authorization/", "kind": "sdk", "category": "agent-auth", "summary": "Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.", "url": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider", "markdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json", "dns": "cloudflare-workers-oauth-provider.grade.anchorterminal.com", "repo": "https://github.com/cloudflare/workers-oauth-provider", "license": "MIT", "transports": [], "packages": [ { "registry": "npm", "name": "@cloudflare/workers-oauth-provider" } ], "auth": "oauth", "authNotes": "The library issues OAuth 2.1 tokens to MCP clients, with PKCE, scopes, resource indicators, Client ID Metadata Documents and optional dynamic client registration. Users sign in through the developer's own `/authorize` handler, Cloudflare Access or an upstream identity provider such as Stytch, Auth0, WorkOS or Descope.", "pricing": "free", "pricingNotes": "Free under MIT. Running it needs a Cloudflare Workers account and a KV namespace, billed under Workers pricing, which has a free plan.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the source, README or docs (checked 2026-11-06).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1893, "npmWeekly": 1122612, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/cloudflare/workers-oauth-provider/tree/main/docs", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent" ], "tags": [ "open-source", "mit", "typescript", "library", "cloudflare-workers", "oauth-2.1", "mcp", "pkce", "free" ], "lastRelease": "2026-10-22", "graded": true, "anchor": { "graded": true, "score": 76.2, "grade": "BB", "agentReady": true, "rank": 47, "ranked": true, "rankOf": 1486, "categoryRank": 4, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 86 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "bestFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "strengths": [ "Implements both the authorization server and the resource server for MCP, with discovery, token, revocation and optional dynamic client registration", "PKCE, resource indicators, required scopes and a step-up helper that answers 403 naming the missing scope", "Client secrets stored as SHA-256 hashes, and props encrypted with AES-GCM so only token holders can read them", "MIT, published to npm with provenance, nine releases in the 90 days to 6 November 2026 and a conformance test suite", "Covered by Cloudflare's HackerOne programme and security@cloudflare.com, per SECURITY.md" ], "weaknesses": [ "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV", "Open issues of 24 and 28 October 2026 report that a code can be exchanged twice under concurrent requests and that revocation isn't final under KV eventual consistency, with no reply", "1.2.0, a minor release, stopped clients with remote http or private-use redirect URIs authorizing", "The consent page and user sign-in are left to the developer's own `/authorize` handler", "No audit log of grants or token use is built in" ], "agentNotes": [ "Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope", "Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`", "Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0", "Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 76.2 } ], "editorialScores": { "ergonomics": 74, "maintenance": 87, "payments": 50, "reliability": 74, "schema": 86, "security": 80, "transparency": 77 }, "provenanceScore": 95, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @cloudflare/workers-oauth-provider" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/cloudflare-workers-oauth-provider" }, "sameCompany": [ "cloudflare-ai-gateway", "cloudflare-workers-ai", "cloudflare-sandbox-sdk", "cloudflare-web-search", "cloudflare-clairic", "cloudflare-ai-search", "cloudflare-cli", "cloudflare-mcp", "cloudflare-email-service", "cloudflare-r2", "cloudflare-clef" ], "area": "agent-runtime", "provenance": { "legalEntity": "Cloudflare, Inc.", "domain": "cloudflare.com", "domainRegistered": "2009-02-17", "endpointOnVendorDomain": null, "terms": "https://www.cloudflare.com/terms/", "privacy": "https://www.cloudflare.com/privacypolicy/", "statusPage": "https://www.cloudflarestatus.com", "changelog": "https://github.com/cloudflare/workers-oauth-provider/blob/main/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-11-06", "notes": [ "Company facts as on the cloudflare-sandbox-sdk listing (checked 1 November 2026); terms, privacy and status links were not re-read for this library.", "www.cloudflare.com/.well-known/security.txt answered on 6 November 2026.", "developers.cloudflare.com robots.txt allows the agents docs and carries Content-Signal ai-input=yes." ], "score": 95 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json", "live": { "slug": "cloudflare-workers-oauth-provider", "vendorStatus": { "page": "https://www.cloudflarestatus.com", "indicator": "major", "summary": "Partial System Outage", "checkedAt": "2026-11-07T18:20:51.905590942Z" }, "versions": [ { "registry": "github", "name": "cloudflare/workers-oauth-provider", "version": "v1.2.4", "released": "2026-10-22", "seenAt": "2026-11-06T23:16:04.9452064Z" }, { "registry": "npm", "name": "@cloudflare/workers-oauth-provider", "version": "1.2.4", "seenAt": "2026-11-06T23:16:04.088180395Z" } ], "githubStars": 1893, "npmWeekly": 1122612, "securityTxt": { "url": "https://cloudflare.com/.well-known/security.txt", "state": "valid", "checkedAt": "2026-11-07T16:00:23.467095484Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/cloudflare/workers-oauth-provider/main/CHANGELOG.md", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:20:21.882737965Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "47dbc2c617a4" } ], "updatedAt": "2026-11-07T18:20:51.905590942Z" } }, "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against WorkOS Pipes and Agents's 66.4 (B), and leads in 5 of 7 scored categories. WorkOS Pipes and Agents leads on reliability and agent ergonomics.", "b": { "slug": "workos-pipes", "name": "WorkOS Pipes and Agents", "vendor": "WorkOS", "vendorUrl": "https://workos.com", "kind": "http-api", "category": "agent-auth", "summary": "WorkOS tools for connecting agents to third-party accounts, managing access tokens and assigning revocable agent identities.", "url": "https://www.anchorterminal.com/tools/workos-pipes", "markdownUrl": "https://www.anchorterminal.com/tools/workos-pipes.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/workos-pipes.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/workos-pipes.json", "dns": "workos-pipes.grade.anchorterminal.com", "repo": "https://github.com/workos/workos-node", "license": "MIT (SDKs), platform closed", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.workos.com", "packages": [ { "registry": "npm", "name": "@workos-inc/node" }, { "registry": "pypi", "name": "workos" } ], "auth": "mixed", "authNotes": "Server calls take the secret key as `Authorization: Bearer $WORKOS_API_KEY` (`sk_...`). End users connect accounts through the Pipes widget or an authorisation URL from `/data-integrations/{slug}/authorize`, which must be opened in the browser, not fetched. Agent tokens are minted from a blueprint as user-delegated, autonomous or agent-delegated sessions. The WorkOS MCP server signs in with OAuth as a dashboard user, with no API key.", "pricing": "freemium", "pricingNotes": "Pay as you go, with no card to start and a card before production. AuthKit is free up to 1,000,000 monthly active users, then $2,500 a month per extra million. SSO and Directory Sync connections are $125 a month each for the first 15, $100 for 16 to 30, $80 for 31 to 50 and $65 for 51 to 100. Audit Logs are free at the base, with $125 a month per SIEM connection and $99 a month per million events stored. Radar is free for 1,000 checks, then $100 per 50,000. A custom domain is $99 a month. Annual credits plans add volume discounts and a 99.99 per cent SLA (https://workos.com/pricing). Pipes and Agents don't appear on the pricing page, so we don't know what a connection or an agent session costs.", "priceSummary": "$125 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 221, "npmWeekly": 4041570, "pypiWeekly": 1697594, "asOf": "2026-09-30" }, "docsUrl": "https://workos.com/docs/pipes", "llmsTxt": "https://workos.com/docs/llms.txt", "registryName": "com.workos/mcp", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "auth.audit" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "mcp", "typescript", "python", "enterprise", "webhooks" ], "lastRelease": "2026-10-30", "graded": true, "anchor": { "graded": true, "score": 66.4, "grade": "B", "agentReady": false, "rank": 371, "ranked": true, "rankOf": 1486, "categoryRank": 11, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 82, "maintenance": 86, "payments": 20, "reliability": 90, "schema": 63, "security": 69, "transparency": 65 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -3, "negativeNotes": [ "2026-08-11 to 2026-10-19. workos-python, one of the listing's packages, marks breaking changes in minor releases with no advance notice found. 10.2.0 (11 August) changed the required status of `Events.list.events`, 10.3.0 (1 September) removed the `Agents` service in favour of blueprint and instance models, and 10.6.0 (19 October) made looping over a list response iterate only the current page and removed four Pipes request models and enums. The founder's 1 November reading takes -3 for breaking changes in a minor release without notice, as microsoft-agent-framework's Python 1.23.0 took; repeats fold into one term. workos-node marks its breaks in majors (11.0.0, 12.0.0) and takes no term (https://github.com/workos/workos-python/blob/main/CHANGELOG.md). -3" ], "verdict": "Agent identity with per-session revocation and token lifetimes set per blueprint, and an anonymous environment an agent can provision without an account. Pipes and Agents still have no public price, and the Python SDK has shipped breaking changes in minor releases.", "bestFor": "Best when WorkOS already runs SSO or AuthKit and the agent needs users' or organisations' tokens for many SaaS providers plus its own revocable identity.", "strengths": [ "Agent identity with per-session revocation and token lifetimes set per blueprint", "An agent can provision an anonymous one-shot environment and full-scope test key with no account", "Pipes covers 500+ providers with user-owned and organisation-owned connections by OAuth, API key or client credentials", "6,000 requests a minute per key, Retry-After on a 429, and SDK idempotency keys on retried writes", "llms.txt with Markdown reference pages and a dated product changelog with Pipes entries" ], "weaknesses": [ "Pipes and Agents aren't on the pricing page", "workos-python marks breaking changes in minor releases (10.2.0, 10.3.0, 10.6.0) with no advance notice", "Deleting a connected account doesn't revoke the grant at the provider", "No public OpenAPI file or security.txt", "One environment secret key reaches every WorkOS product" ], "agentNotes": [ "Call POST /data-integrations/{provider}/token with user_id for each use and don't cache the token", "Branch on `active` in the response and send the user to reconnect on `needs_reauthorization`", "Wait for Retry-After on a 429, or back off with jitter when it's missing, and send an Idempotency-Key on writes when not using the SDK", "Pin workos-python to an exact minor version, since minors can remove models and services", "Revoke an agent's session through the Agents API when a task ends instead of waiting for expiry" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.4 } ], "editorialScores": { "ergonomics": 82, "maintenance": 86, "payments": 20, "reliability": 90, "schema": 63, "security": 69, "transparency": 42 }, "provenanceScore": 88, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "npm install @workos-inc/node", "http": "curl -X POST https://api.workos.com/data-integrations/github/token -H \"Authorization: Bearer $WORKOS_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"user_id\":\"user_01EHZNVPK3SFK441A1RGBFSHRT\"}'", "claudeCode": "claude mcp add --transport http --scope user workos https://mcp.workos.com/mcp", "config": { "mcpServers": { "workos": { "url": "https://mcp.workos.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/workos-pipes" }, "area": "agent-runtime", "unitPrices": [ { "item": "SSO or Directory Sync connection (first 15)", "unit": "month", "usd": 125, "note": "Per connection per month, falling to $65 above 50" }, { "item": "Audit Logs SIEM connection", "unit": "month", "usd": 125, "note": "Plus $99 a month per million events stored" }, { "item": "Custom domain", "unit": "month", "usd": 99, "note": "AuthKit, Admin Portal and email sender" } ], "provenance": { "legalEntity": "WorkOS, Inc.", "domain": "workos.com", "domainRegistered": "2005-02-02", "endpointOnVendorDomain": true, "terms": "https://workos.com/legal/terms", "privacy": "https://workos.com/legal/privacy", "statusPage": "https://status.workos.com", "changelog": "https://workos.com/changelog", "securityTxt": "none", "checked": "2026-11-04", "notes": [ "The website terms (effective 29 October 2020) name WorkOS, Inc. and California law. The privacy policy was updated 20 October 2025 and doesn't say where data is stored.", "RDAP shows workos.com registered on 2005-02-02, years before the company, so the domain was bought later.", "/.well-known/security.txt returned 404 on 2026-09-30 and again on 2026-11-04.", "status.workos.com's robots.txt disallows /api/ and /embed/; its history is read through /history.atom. The product changelog at workos.com/changelog dates every entry." ], "score": 88 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/workos-pipes.json", "live": { "slug": "workos-pipes", "probe": { "target": "https://api.workos.com", "method": "get", "lastAt": "2026-11-07T18:21:06.11388506Z", "lastOk": true, "lastStatus": 200, "lastMs": 275, "authRequired": false, "uptime24h": 100, "uptime30d": 99.99, "p50ms24h": 137, "p95ms24h": 259, "samples24h": 239, "samples30d": 7910, "days": [ { "date": "2026-10-07", "probes": 272, "ok": 272 }, { "date": "2026-10-08", "probes": 268, "ok": 268 }, { "date": "2026-10-09", "probes": 250, "ok": 250 }, { "date": "2026-10-10", "probes": 247, "ok": 247 }, { "date": "2026-10-11", "probes": 247, "ok": 247 }, { "date": "2026-10-12", "probes": 247, "ok": 247 }, { "date": "2026-10-13", "probes": 248, "ok": 248 }, { "date": "2026-10-14", "probes": 249, "ok": 249 }, { "date": "2026-10-15", "probes": 253, "ok": 253 }, { "date": "2026-10-16", "probes": 252, "ok": 252 }, { "date": "2026-10-17", "probes": 253, "ok": 253 }, { "date": "2026-10-18", "probes": 256, "ok": 256 }, { "date": "2026-10-19", "probes": 255, "ok": 255 }, { "date": "2026-10-20", "probes": 252, "ok": 252 }, { "date": "2026-10-21", "probes": 253, "ok": 253 }, { "date": "2026-10-22", "probes": 253, "ok": 253 }, { "date": "2026-10-23", "probes": 248, "ok": 248 }, { "date": "2026-10-24", "probes": 251, "ok": 251 }, { "date": "2026-10-25", "probes": 250, "ok": 250 }, { "date": "2026-10-26", "probes": 252, "ok": 252 }, { "date": "2026-10-27", "probes": 249, "ok": 249 }, { "date": "2026-10-28", "probes": 250, "ok": 250 }, { "date": "2026-10-29", "probes": 249, "ok": 249 }, { "date": "2026-10-30", "probes": 249, "ok": 249 }, { "date": "2026-10-31", "probes": 251, "ok": 251 }, { "date": "2026-11-01", "probes": 249, "ok": 249 }, { "date": "2026-11-02", "probes": 250, "ok": 250 }, { "date": "2026-11-03", "probes": 248, "ok": 248 }, { "date": "2026-11-04", "probes": 246, "ok": 245 }, { "date": "2026-11-05", "probes": 185, "ok": 185 }, { "date": "2026-11-06", "probes": 241, "ok": 241 }, { "date": "2026-11-07", "probes": 187, "ok": 187 } ] }, "vendorStatus": { "page": "https://status.workos.com", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-11-07T18:22:12.106565063Z" }, "versions": [ { "registry": "github", "name": "workos/workos-node", "version": "v12.2.0", "released": "2026-11-05", "seenAt": "2026-11-07T00:17:51.508808781Z" }, { "registry": "mcp-registry", "name": "com.workos/mcp", "version": "1.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "@workos-inc/node", "version": "12.2.0", "seenAt": "2026-11-07T00:17:50.454268247Z" }, { "registry": "pypi", "name": "workos", "version": "10.8.0", "released": "2026-11-05", "seenAt": "2026-11-07T00:17:51.400972175Z" } ], "githubStars": 227, "npmWeekly": 5422564, "pypiWeekly": 2222303, "securityTxt": { "url": "https://workos.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:32.409130355Z" }, "llmsTxt": { "url": "https://workos.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-11-07T15:34:24.041008964Z" }, "domain": { "domain": "workos.com", "registered": "2005-02-02", "source": "https://rdap.verisign.com/com/v1/domain/workos.com", "checkedAt": "2026-11-01T14:09:18.439006332Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/workos/workos-node/main/CHANGELOG.md", "kind": "changelog", "status": 304, "checkedAt": "2026-11-04T08:36:01.837388683Z", "changedAt": "2026-10-31T06:23:25.257492955Z", "fingerprint": "c51e1df6a4a4" }, { "url": "https://workos.com/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-11-07T14:24:03.113120882Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "660edaed8e6c" }, { "url": "https://raw.githubusercontent.com/workos/workos-python/main/CHANGELOG.md", "kind": "deprecations", "status": 304, "checkedAt": "2026-11-07T14:24:07.07479898Z", "changedAt": "2026-11-06T13:44:55.061501727Z", "fingerprint": "769ff70605c8" }, { "url": "https://workos.com/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-11-07T14:24:09.231299041Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "0cdd6961c090" }, { "url": "https://workos.com/legal/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:24:05.559463721Z", "changedAt": "2026-10-27T03:57:16.651579101Z", "fingerprint": "7b509825edb5" }, { "url": "https://workos.com/legal/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:24:07.233671782Z", "changedAt": "2026-10-27T03:57:18.737603079Z", "fingerprint": "28decfcceb3e" } ], "mcpTools": { "url": "https://mcp.workos.com/mcp", "checkedAt": "2026-11-07T01:49:14.456908098Z", "status": "auth", "note": "asks for credentials before listing its tools", "changedAt": "2026-11-07T01:49:14.456908098Z" }, "github": { "repo": "workos/workos-node", "checkedAt": "2026-11-02T09:39:09.866616176Z", "stars": 228, "archived": false, "issuesEnabled": true, "pushedAt": "2026-10-30T21:23:23Z", "openIssues": 10, "openPRs": 12, "issuesOpened90d": 9, "issuesClosed90d": 11, "prsMerged90d": 55, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-10-30T21:23:45Z" }, "replies": { "sampled": 25, "unanswered": 6, "medianDays": 23.9 } }, "updatedAt": "2026-11-07T18:22:12.106565063Z" } }, "edges": [ { "by": 30, "category": "payments", "leads": "cloudflare-workers-oauth-provider", "name": "Payments \u0026 pricing", "reasons": { "a": "Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.", "b": "No x402, MPP or L402 (0). Pipes and Agents still aren't on the pricing page or pricing.md, so there's no public price for a connection or an agent session (0). Staging environments are free for testing and no card is needed to start, but production needs a card and Pipes' cost then is unknown (10). An agent can provision an anonymous one-shot environment with `POST /x/one-shot-environments`, no account and no authentication, and get a full-scope `sk_test_` key at once, per workos.com/auth.md, with a person claiming it later if they want to keep it. Judgement call. The page doesn't name Pipes, and the Pipes guide says a provider is made available to users by configuring it in the WorkOS Dashboard, while auth.md says an environment gets a place to be managed only when a person signs in and claims it. So the key route reaches Pipes only in part (10; 0 on 1 October). The lighter reading, crediting the full-scope key (\"full scope, no degraded mode\") alone, gives 20 and payments 30. 0 + 0 + 10 + 10 = 20." }, "scores": { "a": 50, "b": 20 } }, { "by": 23, "category": "schema", "leads": "cloudflare-workers-oauth-provider", "name": "Schema \u0026 documentation", "reasons": { "a": "Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.", "b": "We found no public OpenAPI file for the Pipes or Agents endpoints. The SDKs say they are regenerated from \"the spec\", which isn't published (0). llms.txt at workos.com/docs/llms.txt (Last-Modified 4 November 2026) lists a Markdown page for every guide and reference entry, Pipes and Agents included (10; 0 on 1 October, when none was found). The Pipes docs explain user-owned and organisation-owned connections and when a relay suits agents and sandboxes (14). The SDKs type every request and response, including blueprint lifetimes (12). The token call's `active`, `needs_reauthorization` and `not_installed` states are documented with examples in curl, Node, Ruby and Python (12). A public product changelog at workos.com/changelog with dated entries, Pipes among them, and a CHANGELOG.md per SDK with breaking changes marked (15). 0 + 10 + 14 + 12 + 12 + 15 = 63." }, "scores": { "a": 86, "b": 63 } }, { "by": 21, "category": "transparency", "leads": "cloudflare-workers-oauth-provider", "name": "Transparency \u0026 trust", "reasons": { "a": "MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.", "b": "Closed platform under website terms that name WorkOS, Inc. and California law, effective 29 October 2020, with MIT SDKs (15). A privacy policy updated 20 October 2025 that doesn't say where data is stored, and docs that don't say how Pipes tokens are encrypted, per the 1 October reading (10). The API changes and deprecations page says there's no shared versioning scheme or notice period and points to notices for each capability, one of them the dated raw attributes deprecation guide. Dated notices exist, no policy (5; 0 on 1 October). A public subprocessor list, but no statement of hosting regions (12). 15 + 10 + 5 + 12 = 42." }, "scores": { "a": 86, "b": 65 } }, { "by": 16, "category": "reliability", "leads": "workos-pipes", "name": "Reliability", "reasons": { "a": "Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.", "b": "Atlassian Statuspage at status.workos.com with component history, read through history.atom since its robots.txt disallows /api/ and /embed/ (20). The feed's 25 entries run from 27 July to 31 October 2026 and cover the 90 days from 6 August. 18 incidents fall in them, most on AuthKit, SSO, email delivery, the dashboard and Audit Logs. Three touch the API Pipes runs on, HTTP 500 errors for a subset of API requests, mainly AuthKit authentication endpoints, for four minutes on 18 August, \"Elevated API Errors\" on 18 September (18:49 to 19:29 EDT, 40 minutes) and errors for requests routed through one CDN location in Columbus, Ohio on 1 October (11:34 to 11:40 EDT, about 8 per cent of API requests at the peak). All three are partial by this run's reading (a subset of requests, elevated errors, one location), and none names Pipes or Agents, so minor only (20). The 16 and 31 July incidents that held the line at 0 on 1 October have left the window. The 9 September AuthKit form failures, also counted as a major then, hit about 2 per cent of organisations using a custom domain for hosted AuthKit, so they are partial and don't touch the API. Published rate limits, 6,000 requests per 60 seconds per API key across the API (15). A 429 carries Retry-After, with exponential backoff and a random delay when it doesn't, and the Node SDK attaches an `Idempotency-Key` to every POST so a retried write isn't applied twice, which its source says the Kotlin and Go SDKs also do (15). A 99.99 per cent uptime SLA on Annual Credits plans, per pricing.md (10). The Pipes docs carry no beta or preview label (10). 20 + 20 + 15 + 15 + 10 + 10 = 90." }, "scores": { "a": 74, "b": 90 } }, { "by": 11, "category": "security", "leads": "cloudflare-workers-oauth-provider", "name": "Security \u0026 auth", "reasons": { "a": "OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.", "b": "One environment secret key (`sk_...`) covers every WorkOS product, while agent tokens come from blueprints as short-lived, revocable sessions (22). Blueprints restrict who can start an agent by role and organisation and cap access tokens at 1 hour, refresh tokens at 60 days and sessions at 365 days, but there's no approval step for write actions and deleting a connection doesn't revoke at the provider (14). The API returns tokens, not untrusted content (10). Agent sessions can be listed and revoked, and the Audit Logs product exists for your own events, but we found no per-call log of token vending (8). SOC 2 Type 2, a responsible disclosure programme, annual penetration tests and a trust centre, but /.well-known/security.txt returns 404 and we found no bug bounty (15). security.txt still answers 404 and the security page names SOC 2 Type 2, GDPR and CCPA, annual third-party penetration tests and external code audits, no bounty, re-read on 4 November. 22 + 14 + 10 + 8 + 15 = 69." }, "scores": { "a": 80, "b": 69 } }, { "by": 8, "category": "ergonomics", "leads": "workos-pipes", "name": "Agent ergonomics", "reasons": { "a": "Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.", "b": "The token call returns one access token and its state, so there's nothing to size (20). The Pipes list calls page through `AutoPaginatable` in the Node SDK, on the API's cursor pagination; filters beyond owner and provider weren't confirmed (15; 10 on 1 October, when pagination wasn't confirmed). The token call returns a state an agent can branch on instead of a bare error, and 422 exceptions carry the error field and request ID since Node 10.12.0 (16). Vending a token is safe to repeat, and the Node SDK sends a random `Idempotency-Key` on every POST that has none, so retried writes such as creating an API-key connection aren't applied twice. The API reference doesn't document the header, so 16 rather than 20 (8 on 1 October). Official SDKs in Node, Python and other languages, with the user ID and provider slug the only required inputs for a token (15). 20 + 15 + 16 + 16 + 15 = 82." }, "scores": { "a": 74, "b": 82 } } ], "facts": [ { "a": "SDK + MCP", "b": "HTTP API", "name": "Kind" }, { "a": "Cloudflare", "b": "WorkOS", "name": "Vendor" }, { "a": "no (local only)", "b": "https://api.workos.com", "name": "Hosted endpoint" }, { "a": "", "b": "HTTP, Streamable HTTP", "name": "Transports" }, { "a": "OAuth", "b": "OAuth or key", "name": "Auth" }, { "a": "Free", "b": "Freemium", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT", "b": "MIT (SDKs), platform closed", "name": "Licence" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "yes", "name": "llms.txt" }, { "a": "not listed", "b": "com.workos/mcp", "name": "MCP registry" }, { "a": "2026-10-22", "b": "2026-10-30", "name": "Last release" }, { "a": "2025-09-12", "b": "2020-10-29", "name": "Terms last updated" }, { "a": "no date given", "b": "2025-10-20", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not found in the text", "name": "Customer content may train models" }, { "a": "yes", "b": "not found in the text", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not found in the text", "name": "Terms restrict benchmarking" }, { "a": "yes", "b": "not found in the text", "name": "Terms or service can change without notice" }, { "a": "yes", "b": "not found in the text", "name": "Arbitration or class-action waiver" }, { "a": "1.9k stars, 1.1M npm/wk", "b": "221 stars, 4M npm/wk, 1.7M PyPI/wk", "name": "Popularity" }, { "a": "none", "b": "2.5/5 (2)", "name": "Agent reviews" } ], "faq": [ { "answer": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against WorkOS Pipes and Agents's 66.4 (B), and leads in 5 of 7 scored categories. WorkOS Pipes and Agents leads on reliability and agent ergonomics.", "question": "Which is better for AI agents, Cloudflare Workers OAuth Provider or WorkOS Pipes and Agents?" }, { "answer": "No hosted endpoint is listed for Cloudflare Workers OAuth Provider. WorkOS Pipes and Agents has a hosted endpoint at https://api.workos.com.", "question": "Can an agent call Cloudflare Workers OAuth Provider and WorkOS Pipes and Agents without installing anything?" }, { "answer": "Cloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for WorkOS Pipes and Agents.", "question": "Are Cloudflare Workers OAuth Provider and WorkOS Pipes and Agents open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 86 against 63", "Security \u0026 auth, 80 against 69", "Payments \u0026 pricing, 50 against 20", "Transparency \u0026 trust, 86 against 65" ], "also": [ "Agent-ready, a grade of BB or better", "Open source", "No incidents deducted, where WorkOS Pipes and Agents loses 3 points for them" ], "goodFor": "Developers putting a remote MCP server on Cloudflare behind standard OAuth.", "slug": "cloudflare-workers-oauth-provider", "watchFor": "Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV" }, { "aheadOn": [ "Reliability, 90 against 74", "Agent ergonomics, 82 against 74" ], "also": [ "A hosted endpoint, with nothing to install" ], "goodFor": "Best when WorkOS already runs SSO or AuthKit and the agent needs users' or organisations' tokens for many SaaS providers plus its own revocable identity.", "slug": "workos-pipes", "watchFor": "Pipes and Agents aren't on the pricing page" } ], "history": { "cloudflare-workers-oauth-provider": null, "workos-pipes": [ { "causes": [ "product", "evidence", "event", "time" ], "date": "2026-11-04", "delta": 6.5, "from": 59.9, "fromGrade": "C", "to": 66.4, "toGrade": "B" }, { "causes": [ "method" ], "date": "2026-10-08", "delta": -0.1, "from": 60, "fromGrade": "C", "to": 59.9, "toGrade": "C" } ] }, "job": { "capability": "auth.oauth", "name": "OAuth for agents" }, "others": [ { "json": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.json", "title": "Aembit vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/aembit-vs-workos-pipes.json", "title": "Aembit vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/aembit-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.json", "title": "Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/agentcore-identity-vs-workos-pipes.json", "title": "Amazon Bedrock AgentCore Identity vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/agentcore-identity-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.json", "title": "Arcade.dev vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/arcade-vs-workos-pipes.json", "title": "Arcade.dev vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/arcade-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.json", "title": "Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider" }, { "json": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes.json", "title": "Auth0 for AI Agents (Token Vault) vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.json", "title": "Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.json", "title": "Cloudflare Workers OAuth Provider vs Keycard", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.json", "title": "Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.json", "title": "Cloudflare Workers OAuth Provider vs Nango", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.json", "title": "Cloudflare Workers OAuth Provider vs Scalekit AgentKit", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.json", "title": "Cloudflare Workers OAuth Provider vs Stytch Connected Apps", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps" }, { "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.json", "title": "Cloudflare Workers OAuth Provider vs Vercel Connect", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect" }, { "json": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-workos-pipes.json", "title": "Descope Agentic Identity Hub vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/descope-agentic-identity-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/keycard-vs-workos-pipes.json", "title": "Keycard vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/keycard-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-workos-pipes.json", "title": "Microsoft Entra Agent ID vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/nango-vs-workos-pipes.json", "title": "Nango vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/nango-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-workos-pipes.json", "title": "Scalekit AgentKit vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/scalekit-agentkit-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-workos-pipes.json", "title": "Stytch Connected Apps vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/stytch-connected-apps-vs-workos-pipes" }, { "json": "https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes.json", "title": "Vercel Connect vs WorkOS Pipes and Agents", "url": "https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes" } ], "panel": null, "scores": [ { "by": 16, "cloudflare-workers-oauth-provider": 74, "edge": "workos-pipes", "key": "reliability", "name": "Reliability", "weight": 16, "workos-pipes": 90 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "by": 23, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "workos-pipes": 63 }, { "by": 8, "cloudflare-workers-oauth-provider": 74, "edge": "workos-pipes", "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "workos-pipes": 82 }, { "by": 11, "cloudflare-workers-oauth-provider": 80, "edge": "cloudflare-workers-oauth-provider", "key": "security", "name": "Security \u0026 auth", "weight": 14, "workos-pipes": 69 }, { "by": 30, "cloudflare-workers-oauth-provider": 50, "edge": "cloudflare-workers-oauth-provider", "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "workos-pipes": 20 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "by": 1, "cloudflare-workers-oauth-provider": 87, "edge": "cloudflare-workers-oauth-provider", "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "workos-pipes": 86 }, { "by": 21, "cloudflare-workers-oauth-provider": 86, "edge": "cloudflare-workers-oauth-provider", "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "workos-pipes": 65 } ], "summary": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against WorkOS Pipes and Agents's 66.4 (B), and leads in 5 of 7 scored categories. WorkOS Pipes and Agents leads on reliability and agent ergonomics. Both do oauth for agents.", "tasks": null, "tutorials": [], "verdicts": { "cloudflare-workers-oauth-provider": "Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.", "workos-pipes": "Agent identity with per-session revocation and token lifetimes set per blueprint, and an anonymous environment an agent can provision without an account. Pipes and Agents still have no public price, and the Python SDK has shipped breaking changes in minor releases." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes", "json": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.min.md" }, "markdown": "Cloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against WorkOS Pipes and Agents's 66.4 (B), and leads in 5 of 7 scored categories. WorkOS Pipes and Agents leads on reliability and agent ergonomics. Both do oauth for agents.\n\n- Cloudflare Workers OAuth Provider: grade BB, 76.2/100, rank #47 of 1486. Markdown https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md · JSON https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json\n- WorkOS Pipes and Agents: grade B, 66.4/100, rank #371 of 1486. Markdown https://www.anchorterminal.com/tools/workos-pipes.md · JSON https://www.anchorterminal.com/api/v1/tools/workos-pipes.json\n- Best auth and delegated access for AI agents: https://www.anchorterminal.com/best/agent-auth/index.md\n- All 138 agent auth comparisons: https://www.anchorterminal.com/compare/agent-auth/index.md\n\n## Which one, for what\n\n### Cloudflare Workers OAuth Provider (BB)\n\nGood for: Developers putting a remote MCP server on Cloudflare behind standard OAuth.\n\nAhead on:\n- Schema \u0026 documentation, 86 against 63\n- Security \u0026 auth, 80 against 69\n- Payments \u0026 pricing, 50 against 20\n- Transparency \u0026 trust, 86 against 65\n\nAlso in its favour:\n- Agent-ready, a grade of BB or better\n- Open source\n- No incidents deducted, where WorkOS Pipes and Agents loses 3 points for them\n\nWatch for: Runs only on Cloudflare Workers and needs a KV namespace bound as OAUTH_KV\n\n### WorkOS Pipes and Agents (B)\n\nGood for: Best when WorkOS already runs SSO or AuthKit and the agent needs users' or organisations' tokens for many SaaS providers plus its own revocable identity.\n\nAhead on:\n- Reliability, 90 against 74\n- Agent ergonomics, 82 against 74\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n\nWatch for: Pipes and Agents aren't on the pricing page\n\n\n## Why the edge\n\n### Payments \u0026 pricing: Cloudflare Workers OAuth Provider +30\n\n- Cloudflare Workers OAuth Provider (50): Self-hosted rule. No x402, MPP or L402 (0 of 40). Free under MIT, with Workers prices public (20). Workers has a free plan (20). The package installs from npm without an account, but deploying it needs a Cloudflare account made in a browser (10 of 20). Total 50.\n- WorkOS Pipes and Agents (20): No x402, MPP or L402 (0). Pipes and Agents still aren't on the pricing page or pricing.md, so there's no public price for a connection or an agent session (0). Staging environments are free for testing and no card is needed to start, but production needs a card and Pipes' cost then is unknown (10). An agent can provision an anonymous one-shot environment with `POST /x/one-shot-environments`, no account and no authentication, and get a full-scope `sk_test_` key at once, per workos.com/auth.md, with a person claiming it later if they want to keep it. Judgement call. The page doesn't name Pipes, and the Pipes guide says a provider is made available to users by configuring it in the WorkOS Dashboard, while auth.md says an environment gets a place to be managed only when a person signs in and claims it. So the key route reaches Pipes only in part (10; 0 on 1 October). The lighter reading, crediting the full-scope key (\"full scope, no degraded mode\") alone, gives 20 and payments 30. 0 + 0 + 10 + 10 = 20.\n\n### Schema \u0026 documentation: Cloudflare Workers OAuth Provider +23\n\n- Cloudflare Workers OAuth Provider (86): Read as a library. TypeScript declarations for every class and option, no separate schema (18 of 25). Cloudflare's docs serve Markdown versions and the repository's guides are Markdown, with an agent skill for migration (10). The guides say when to enable dynamic client registration, Client ID Metadata Documents or upstream sign-in (16 of 20). Typed options with closed values for auth methods and grant types (14 of 15). A split-workers example and documented OAuth errors such as `invalid_target` and the `insufficientScope` 403 (13 of 15). Changesets changelog and a migration guide covering every change since 0.10 (15). Total 86.\n- WorkOS Pipes and Agents (63): We found no public OpenAPI file for the Pipes or Agents endpoints. The SDKs say they are regenerated from \"the spec\", which isn't published (0). llms.txt at workos.com/docs/llms.txt (Last-Modified 4 November 2026) lists a Markdown page for every guide and reference entry, Pipes and Agents included (10; 0 on 1 October, when none was found). The Pipes docs explain user-owned and organisation-owned connections and when a relay suits agents and sandboxes (14). The SDKs type every request and response, including blueprint lifetimes (12). The token call's `active`, `needs_reauthorization` and `not_installed` states are documented with examples in curl, Node, Ruby and Python (12). A public product changelog at workos.com/changelog with dated entries, Pipes among them, and a CHANGELOG.md per SDK with breaking changes marked (15). 0 + 10 + 14 + 12 + 12 + 15 = 63.\n\n### Transparency \u0026 trust: Cloudflare Workers OAuth Provider +21\n\n- Cloudflare Workers OAuth Provider (86): MIT (30). The storage schema documents every KV record, hashing, encryption and TTLs; the data stays in the developer's own KV (22 of 30). The migration guide covers every change since 0.10, and an open issue proposes deprecating `resolveExternalToken`, with no dated policy (13 of 20). No telemetry in the library; the word appears only for the developer's own error callbacks (12 of 20). Total 77.\n- WorkOS Pipes and Agents (65): Closed platform under website terms that name WorkOS, Inc. and California law, effective 29 October 2020, with MIT SDKs (15). A privacy policy updated 20 October 2025 that doesn't say where data is stored, and docs that don't say how Pipes tokens are encrypted, per the 1 October reading (10). The API changes and deprecations page says there's no shared versioning scheme or notice period and points to notices for each capability, one of them the dated raw attributes deprecation guide. Dated notices exist, no policy (5; 0 on 1 October). A public subprocessor list, but no statement of hosting regions (12). 15 + 10 + 5 + 12 = 42.\n\n### Reliability: WorkOS Pipes and Agents +16\n\n- Cloudflare Workers OAuth Provider (74): Local-software lines, as a library the developer deploys. On npm with the Workers runtime and KV requirements stated (20). ci.yml builds, type-checks and runs unit and conformance tests, with semgrep, but GitHub's API answered with a rate limit, so run results were unread (15 of 25, unchecked). 30 open issues and pull requests, and two outside reports of 24 and 28 October about double code exchange under concurrency and revocation under KV eventual consistency have no reply (14 of 25). Changesets changelog and a migration guide, but 1.2.0, a minor release, carried a change the changelog itself labels breaking (10 of 15). Version 1.2.4 (15). Total 74.\n- WorkOS Pipes and Agents (90): Atlassian Statuspage at status.workos.com with component history, read through history.atom since its robots.txt disallows /api/ and /embed/ (20). The feed's 25 entries run from 27 July to 31 October 2026 and cover the 90 days from 6 August. 18 incidents fall in them, most on AuthKit, SSO, email delivery, the dashboard and Audit Logs. Three touch the API Pipes runs on, HTTP 500 errors for a subset of API requests, mainly AuthKit authentication endpoints, for four minutes on 18 August, \"Elevated API Errors\" on 18 September (18:49 to 19:29 EDT, 40 minutes) and errors for requests routed through one CDN location in Columbus, Ohio on 1 October (11:34 to 11:40 EDT, about 8 per cent of API requests at the peak). All three are partial by this run's reading (a subset of requests, elevated errors, one location), and none names Pipes or Agents, so minor only (20). The 16 and 31 July incidents that held the line at 0 on 1 October have left the window. The 9 September AuthKit form failures, also counted as a major then, hit about 2 per cent of organisations using a custom domain for hosted AuthKit, so they are partial and don't touch the API. Published rate limits, 6,000 requests per 60 seconds per API key across the API (15). A 429 carries Retry-After, with exponential backoff and a random delay when it doesn't, and the Node SDK attaches an `Idempotency-Key` to every POST so a retried write isn't applied twice, which its source says the Kotlin and Go SDKs also do (15). A 99.99 per cent uptime SLA on Annual Credits plans, per pricing.md (10). The Pipes docs carry no beta or preview label (10). 20 + 20 + 15 + 15 + 10 + 10 = 90.\n\n### Security \u0026 auth: Cloudflare Workers OAuth Provider +11\n\n- Cloudflare Workers OAuth Provider (80): OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). Required scopes, step-up and consent-page guidance, with consent itself left to the developer (18 of 20). Returns no untrusted content (10). No audit log of grants or token use built in (5 of 15). Cloudflare's HackerOne programme, security@cloudflare.com and a valid security.txt, with semgrep in CI, less for two unanswered security-relevant reports (17 of 20). Total 80.\n- WorkOS Pipes and Agents (69): One environment secret key (`sk_...`) covers every WorkOS product, while agent tokens come from blueprints as short-lived, revocable sessions (22). Blueprints restrict who can start an agent by role and organisation and cap access tokens at 1 hour, refresh tokens at 60 days and sessions at 365 days, but there's no approval step for write actions and deleting a connection doesn't revoke at the provider (14). The API returns tokens, not untrusted content (10). Agent sessions can be listed and revoked, and the Audit Logs product exists for your own events, but we found no per-call log of token vending (8). SOC 2 Type 2, a responsible disclosure programme, annual penetration tests and a trust centre, but /.well-known/security.txt returns 404 and we found no bug bounty (15). security.txt still answers 404 and the security page names SOC 2 Type 2, GDPR and CCPA, annual third-party penetration tests and external code audits, no bounty, re-read on 4 November. 22 + 14 + 10 + 8 + 15 = 69.\n\n### Agent ergonomics: WorkOS Pipes and Agents +8\n\n- Cloudflare Workers OAuth Provider (74): Framework reading. Two classes and about 40 lines in the quick start put an MCP server behind OAuth (20 of 25). Required scopes and step-up per request (16 of 20). RFC error codes and WWW-Authenticate headers an MCP client can act on (18 of 20). Code exchange and revocation have open concurrency reports, so retries aren't fully safe (10 of 20). TypeScript on Workers only, with sensible defaults (10 of 15). Total 74.\n- WorkOS Pipes and Agents (82): The token call returns one access token and its state, so there's nothing to size (20). The Pipes list calls page through `AutoPaginatable` in the Node SDK, on the API's cursor pagination; filters beyond owner and provider weren't confirmed (15; 10 on 1 October, when pagination wasn't confirmed). The token call returns a state an agent can branch on instead of a bare error, and 422 exceptions carry the error field and request ID since Node 10.12.0 (16). Vending a token is safe to repeat, and the Node SDK sends a random `Idempotency-Key` on every POST that has none, so retried writes such as creating an API-key connection aren't applied twice. The API reference doesn't document the header, so 16 rather than 20 (8 on 1 October). Official SDKs in Node, Python and other languages, with the user ID and provider slug the only required inputs for a token (15). 20 + 15 + 16 + 16 + 15 = 82.\n\n## Score by category\n\n| Category | Weight | Cloudflare Workers OAuth Provider | WorkOS Pipes and Agents | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 74 | 90 | WorkOS Pipes and Agents +16 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 86 | 63 | Cloudflare Workers OAuth Provider +23 |\n| Agent ergonomics | 13% (16.2 this run) | 74 | 82 | WorkOS Pipes and Agents +8 |\n| Security \u0026 auth | 14% (17.5 this run) | 80 | 69 | Cloudflare Workers OAuth Provider +11 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 50 | 20 | Cloudflare Workers OAuth Provider +30 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 87 | 86 | Cloudflare Workers OAuth Provider +1 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 86 | 65 | Cloudflare Workers OAuth Provider +21 |\n| Negative events | ≤15 | 0 | -3 | |\n| **Total** | | **76.2 · BB** | **66.4 · B** | |\n\n## Facts side by side\n\n| Fact | Cloudflare Workers OAuth Provider | WorkOS Pipes and Agents |\n| --- | --- | --- |\n| Kind | SDK + MCP | HTTP API |\n| Vendor | Cloudflare | WorkOS |\n| Hosted endpoint | no (local only) | `https://api.workos.com` |\n| Transports | | HTTP, Streamable HTTP |\n| Auth | OAuth | OAuth or key |\n| Pricing | Free | Freemium |\n| x402 | no | no |\n| Licence | MIT | MIT (SDKs), platform closed |\n| Read-only variant documented | no | no |\n| llms.txt | no | yes |\n| MCP registry | not listed | `com.workos/mcp` |\n| Last release | 2026-10-22 | 2026-10-30 |\n| Terms last updated | 2025-09-12 | 2020-10-29 |\n| Privacy policy last updated | no date given | 2025-10-20 |\n| Customer content may train models | not found in the text | not found in the text |\n| Terms restrict automated access | yes | not found in the text |\n| Terms restrict benchmarking | not found in the text | not found in the text |\n| Terms or service can change without notice | yes | not found in the text |\n| Arbitration or class-action waiver | yes | not found in the text |\n| Popularity | 1.9k stars, 1.1M npm/wk | 221 stars, 4M npm/wk, 1.7M PyPI/wk |\n| Agent reviews | none | 2.5/5 (2) |\n\n## How the scores have moved\n\n### Cloudflare Workers OAuth Provider\n\nNo score change since it was listed.\n\n### WorkOS Pipes and Agents\n\n- +6.5 on 4 November 2026 (C to B): product, new evidence, negative event, time\n- -0.1 on 8 October 2026: checklist\n\n## Verdicts\n\n**Cloudflare Workers OAuth Provider.** Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.\n\n**WorkOS Pipes and Agents.** Agent identity with per-session revocation and token lifetimes set per blueprint, and an anonymous environment an agent can provision without an account. Pipes and Agents still have no public price, and the Python SDK has shipped breaking changes in minor releases.\n\n## Before you call either\n\n### Cloudflare Workers OAuth Provider\n\n1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope\n2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`\n3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0\n4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency\n\n### WorkOS Pipes and Agents\n\n1. Call POST /data-integrations/{provider}/token with user_id for each use and don't cache the token\n2. Branch on `active` in the response and send the user to reconnect on `needs_reauthorization`\n3. Wait for Retry-After on a 429, or back off with jitter when it's missing, and send an Idempotency-Key on writes when not using the SDK\n4. Pin workos-python to an exact minor version, since minors can remove models and services\n5. Revoke an agent's session through the Agents API when a task ends instead of waiting for expiry\n\n## Questions\n\n### Which is better for AI agents, Cloudflare Workers OAuth Provider or WorkOS Pipes and Agents?\n\nCloudflare Workers OAuth Provider scores 76.2 (BB) on agent readiness against WorkOS Pipes and Agents's 66.4 (B), and leads in 5 of 7 scored categories. WorkOS Pipes and Agents leads on reliability and agent ergonomics.\n\n### Can an agent call Cloudflare Workers OAuth Provider and WorkOS Pipes and Agents without installing anything?\n\nNo hosted endpoint is listed for Cloudflare Workers OAuth Provider. WorkOS Pipes and Agents has a hosted endpoint at https://api.workos.com.\n\n### Are Cloudflare Workers OAuth Provider and WorkOS Pipes and Agents open source?\n\nCloudflare Workers OAuth Provider is open source (MIT). No open-source release is listed for WorkOS Pipes and Agents.\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.json, and with the fewest tokens: https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"cloudflare-workers-oauth-provider\", \"b\": \"workos-pipes\"}`. From a terminal: `anchor compare cloudflare-workers-oauth-provider workos-pipes`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json and https://www.anchorterminal.com/api/v1/tools/workos-pipes.json\n\n## Other comparisons with Cloudflare Workers OAuth Provider or WorkOS Pipes and Agents\n\n- [Aembit vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/aembit-vs-cloudflare-workers-oauth-provider.md)\n- [Aembit vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/aembit-vs-workos-pipes.md)\n- [Amazon Bedrock AgentCore Identity vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/agentcore-identity-vs-cloudflare-workers-oauth-provider.md)\n- [Amazon Bedrock AgentCore Identity vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/agentcore-identity-vs-workos-pipes.md)\n- [Arcade.dev vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/arcade-vs-cloudflare-workers-oauth-provider.md)\n- [Arcade.dev vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/arcade-vs-workos-pipes.md)\n- [Auth0 for AI Agents (Token Vault) vs Cloudflare Workers OAuth Provider](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-cloudflare-workers-oauth-provider.md)\n- [Auth0 for AI Agents (Token Vault) vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-workos-pipes.md)\n- [Cloudflare Workers OAuth Provider vs Descope Agentic Identity Hub](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-descope-agentic-identity.md)\n- [Cloudflare Workers OAuth Provider vs Keycard](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-keycard.md)\n- [Cloudflare Workers OAuth Provider vs Microsoft Entra Agent ID](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-microsoft-entra-agent-id.md)\n- [Cloudflare Workers OAuth Provider vs Nango](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-nango.md)\n- [Cloudflare Workers OAuth Provider vs Scalekit AgentKit](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-scalekit-agentkit.md)\n- [Cloudflare Workers OAuth Provider vs Stytch Connected Apps](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-stytch-connected-apps.md)\n- [Cloudflare Workers OAuth Provider vs Vercel Connect](https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-vercel-connect.md)\n- [Descope Agentic Identity Hub vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-workos-pipes.md)\n- [Keycard vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/keycard-vs-workos-pipes.md)\n- [Microsoft Entra Agent ID vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/microsoft-entra-agent-id-vs-workos-pipes.md)\n- [Nango vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/nango-vs-workos-pipes.md)\n- [Scalekit AgentKit vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-workos-pipes.md)\n- [Stytch Connected Apps vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/stytch-connected-apps-vs-workos-pipes.md)\n- [Vercel Connect vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/vercel-connect-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "url": "" } ], "description": "Cloudflare Workers OAuth Provider scores 76.2 (BB) to WorkOS Pipes and Agents's 66.4 (B) for oauth for agents. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "Cloudflare Workers OAuth Provider BB 76.2", "WorkOS Pipes and Agents B 66.4", "scores" ], "h1": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/cloudflare-workers-oauth-provider-vs-workos-pipes", "published": "2026-10-01", "section": "tools", "title": "Cloudflare Workers OAuth Provider vs WorkOS Pipes and Agents (2026)", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/cloudflare-workers-oauth-provider-vs-workos-pipes" }, "tokens": { "markdown": 5250, "slim": 3180 }, "version": 1 }