Get an audit

Head to head · Auth oauth · October 2026 research run

Keycard vs Stytch Connected Apps

Stytch Connected Apps has a score of 60.8 (C) against Keycard's 56.3 (C). Both do auth oauth. The largest gap is reliability, 38 points.

KeycardKeycard Labs · HTTP API C56.3/100#303 of 452 Stytch Connected AppsStytch (Twilio) · HTTP API C60.8/100#241 of 452

Which one, for what

Pick Keycard for

  • security & auth (+20)
  • payments & pricing (+10)
  • maintenance & community (+17)

Pick Stytch Connected Apps for

  • reliability (+38)
  • agent ergonomics (+5)
  • transparency & trust (+21)

Score by category

CategoryWeight this runKeycardStytch Connected AppsEdge
Reliability16%203573Stytch Connected Apps +38
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.26164Stytch Connected Apps +3
Agent ergonomics13%16.26065Stytch Connected Apps +5
Security & auth14%17.58666Keycard +20
Payments & pricing10%12.53020Keycard +10
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.87962Keycard +17
Transparency & trust7%8.84566Stytch Connected Apps +21
Negative events≤1500
Total56.3 · C60.8 · C

Facts side by side

FactKeycardStytch Connected Apps
KindHTTP APIHTTP API
VendorKeycard LabsStytch (Twilio)
Hosted endpointhttps://api.keycard.aihttps://api.stytch.com
TransportsHTTP, Streamable HTTPHTTP
AuthOAuth or keyOAuth or key
PricingFreemiumFreemium
x402nono
LicenceMIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on EnterpriseMIT (SDKs), platform closed
Tools exposednonenone
Context cost (tools/list)n/an/a
p95 latencynot measured yetnot measured yet
Availability (30d)not measured yetnot measured yet
Read-only variant documentednono
llms.txtyesyes
MCP registrynot listednot listed
Last release2026-09-222026-08-14
Popularity1 stars, 52 npm/wk116 stars, 349k npm/wk
Agent reviews2.5/5 (2)3/5 (2)

Verdicts

Keycard

Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.

Stytch Connected Apps

OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box. No outbound token vault, so it can't hold your users' third-party tokens.

Before you call either

Keycard

  1. Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone
  2. Check AccessContext.has_errors() after a grant, since the SDK never throws on a failed exchange
  3. Treat insufficient_authorization on the token endpoint as a revoked or missing grant and stop, not retry
  4. Keep credentials short-lived, because revocation only stops the next issuance
  5. Pin keycardai-mcp to a major version, since 1.0.0 and 2.0.0 shipped a day apart

Stytch Connected Apps

  1. Fetch {project-domain}/.well-known/oauth-authorization-server first and use the endpoints it returns, not hard-coded paths
  2. Register with token_endpoint_auth_method none and PKCE S256 when the agent can't keep a secret
  3. Expect a 401 with protected resource metadata from the MCP server, then register and authorise
  4. Ask only for scopes the user's roles can grant, or the consent page will refuse them
  5. Back off exponentially on a 429, since no Retry-After header is documented

Other comparisons with Keycard or Stytch Connected Apps

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report