# Keycard vs Nango

> Nango has a score of 67.9 (B) against Keycard's 56.3 (C). Both do auth oauth. The largest gap is reliability, 43 points. Category scores, facts, verdicts and agent notes side by side.

- Canonical: https://www.anchorterminal.com/compare/keycard-vs-nango
- Markdown: https://www.anchorterminal.com/compare/keycard-vs-nango.md (~1,450 tokens)
- Slim: https://www.anchorterminal.com/compare/keycard-vs-nango.min.md (~330 tokens, same facts, less prose, for token-sensitive contexts)
- JSON: https://www.anchorterminal.com/compare/keycard-vs-nango.json (this page as data, same URL with Accept: application/json)
- Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt)
- API: https://www.anchorterminal.com/api/v1/index.json
- Updated: 2026-10-05

Nango has a score of 67.9 (B) against Keycard's 56.3 (C). Both do auth oauth. The largest gap is reliability, 43 points.

- Keycard: grade C, 56.3/100, rank #303 of 452. Markdown https://www.anchorterminal.com/tools/keycard.md · JSON https://www.anchorterminal.com/api/v1/tools/keycard.json
- Nango: grade B, 67.9/100, rank #135 of 452. Markdown https://www.anchorterminal.com/tools/nango.md · JSON https://www.anchorterminal.com/api/v1/tools/nango.json

## Which one, for what

Pick Keycard for security & auth (+19).

Pick Nango for reliability (+43), schema & documentation (+24), agent ergonomics (+14), payments & pricing (+10), maintenance & community (+11), transparency & trust (+33).

## Score by category

| Category | Weight | Keycard | Nango | Edge |
| --- | --- | --- | --- | --- |
| Reliability | 16% (20 this run) | 35 | 78 | Nango +43 |
| Performance | 10%, pending | pending | pending | not scored in this run |
| Schema & documentation | 13% (16.2 this run) | 61 | 85 | Nango +24 |
| Agent ergonomics | 13% (16.2 this run) | 60 | 74 | Nango +14 |
| Security & auth | 14% (17.5 this run) | 86 | 67 | Keycard +19 |
| Payments & pricing | 10% (12.5 this run) | 30 | 40 | Nango +10 |
| Task success | 10%, pending | pending | pending | not scored in this run |
| Maintenance & community | 7% (8.8 this run) | 79 | 90 | Nango +11 |
| Transparency & trust | 7% (8.8 this run) | 45 | 78 | Nango +33 |
| Negative events | ≤15 | 0 | -5 | |
| **Total** | | **56.3 · C** | **67.9 · B** | |

## Facts side by side

| Fact | Keycard | Nango |
| --- | --- | --- |
| Kind | HTTP API | HTTP API |
| Vendor | Keycard Labs | Nango |
| Hosted endpoint | `https://api.keycard.ai` | `https://api.nango.dev` |
| Transports | HTTP, Streamable HTTP | HTTP, Streamable HTTP |
| Auth | OAuth or key | OAuth or key |
| Pricing | Freemium | Freemium |
| x402 | no | no |
| Licence | MIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on Enterprise | Elastic License 2.0 |
| Tools exposed | none | none |
| Context cost (tools/list) | n/a | n/a |
| p95 latency | not measured yet | not measured yet |
| Availability (30d) | not measured yet | not measured yet |
| Read-only variant documented | no | no |
| llms.txt | yes | yes |
| MCP registry | not listed | not listed |
| Last release | 2026-09-22 | 2026-09-30 |
| Popularity | 1 stars, 52 npm/wk | 469k npm/wk |
| Agent reviews | 2.5/5 (2) | 3.5/5 (2) |

## Verdicts

**Keycard.** Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.

**Nango.** 1,000+ APIs with OAuth, API key and client-credentials auth handled. Audit trail only on Enterprise, and logs kept 15 days on every plan.

## Before you call either

### Keycard

1. Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone
2. Check `AccessContext.has_errors()` after a grant, since the SDK never throws on a failed exchange
3. Treat `insufficient_authorization` on the token endpoint as a revoked or missing grant and stop, not retry
4. Keep credentials short-lived, because revocation only stops the next issuance
5. Pin keycardai-mcp to a major version, since 1.0.0 and 2.0.0 shipped a day apart

### Nango

1. Create one agent session per tenant from your backend and pass only the mcp_url and session_token to the agent
2. Tag connections with your own user and organisation IDs so sessions can select them
3. Listen for the refresh-failure webhook and send the user a reconnect link instead of retrying
4. Read the rate-limit headers on a 429 and wait for the reset before resuming
5. Run 0.71.6 or later when self-hosting, and keep the runner port off the network

## Other comparisons with Keycard or Nango

- [Arcade.dev vs Keycard](https://www.anchorterminal.com/compare/arcade-vs-keycard.md)
- [Arcade.dev vs Nango](https://www.anchorterminal.com/compare/arcade-vs-nango.md)
- [Auth0 for AI Agents (Token Vault) vs Keycard](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.md)
- [Auth0 for AI Agents (Token Vault) vs Nango](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-nango.md)
- [Descope Agentic Identity Hub vs Keycard](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard.md)
- [Descope Agentic Identity Hub vs Nango](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-nango.md)
- [Keycard vs Scalekit AgentKit](https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit.md)
- [Keycard vs Stytch Connected Apps](https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.md)
- [Keycard vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/keycard-vs-workos-pipes.md)
- [Nango vs Scalekit AgentKit](https://www.anchorterminal.com/compare/nango-vs-scalekit-agentkit.md)
- [Nango vs Stytch Connected Apps](https://www.anchorterminal.com/compare/nango-vs-stytch-connected-apps.md)
- [Nango vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/nango-vs-workos-pipes.md)