Keycard vs Nango

Keycard

Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.

Nango

1,000+ APIs with OAuth, API key and client-credentials auth handled. Audit trail only on Enterprise, and logs kept 15 days on every plan.

Keycard

1. Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone
2. Check AccessContext.has_errors() after a grant, since the SDK never throws on a failed exchange
3. Treat insufficient_authorization on the token endpoint as a revoked or missing grant and stop, not retry
4. Keep credentials short-lived, because revocation only stops the next issuance
5. Pin keycardai-mcp to a major version, since 1.0.0 and 2.0.0 shipped a day apart

Nango

1. Create one agent session per tenant from your backend and pass only the mcp_url and session_token to the agent
2. Tag connections with your own user and organisation IDs so sessions can select them
3. Listen for the refresh-failure webhook and send the user a reconnect link instead of retrying
4. Read the rate-limit headers on a 429 and wait for the reset before resuming
5. Run 0.71.6 or later when self-hosting, and keep the runner port off the network