{ "data": { "a": { "slug": "keycard", "name": "Keycard", "vendor": "Keycard Labs", "vendorUrl": "https://www.keycard.ai", "kind": "http-api", "category": "agent-auth", "summary": "Identity and access platform for AI agents.", "url": "https://www.anchorterminal.com/tools/keycard", "markdownUrl": "https://www.anchorterminal.com/tools/keycard.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/keycard.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/keycard.json", "repo": "https://github.com/keycardai/python-sdk", "license": "MIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on Enterprise", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://api.keycard.ai", "packages": [ { "registry": "pypi", "name": "keycardai-mcp" }, { "registry": "pypi", "name": "keycardai-fastmcp" }, { "registry": "npm", "name": "@keycardai/mcp" }, { "registry": "pypi", "name": "keycardai_api" } ], "auth": "mixed", "authNotes": "The management API at api.keycard.ai takes `Authorization: Bearer $KEYCARD_API_KEY` (a service account key). Agents and MCP servers talk OAuth 2.0 to their zone at `https://\u003czone-id\u003e.keycard.cloud`, discovered from `/.well-known/oauth-authorization-server`, with PKCE, dynamic client registration and RFC 8693 token exchange against the token endpoint. Application credentials are a client secret, a web identity (OIDC) or EKS workload identity. Tokens are JWTs verified against the zone's JWKS.", "pricing": "freemium", "pricingNotes": "Starter is free with 5,000 transactions a month as a hard cap, unlimited users, agents and apps, RBAC, ABAC and ReBAC policies, 7-day telemetry retention and community support. Team is $500 a month with 100,000 transactions and $1 per 1,000 after, SSO, zone policy, 90-day retention, email support and an SLA. Enterprise is custom on an annual commitment, with org and device-based policy, SCIM, Active Directory and LDAP provisioning, dedicated, BYOC or on-prem deployment, private networking, customer-managed KMS, 180-day retention, a 99.95 per cent uptime SLA and 1-hour 24/7 response on P1 issues. A transaction is recorded each time Keycard issues a credential, validates an access request or exchanges a credential (https://www.keycard.ai/pricing). The page doesn't say whether a card is needed, and its sign-up form ends with a promise to be in touch. The quickstart calls the product Early Access, with sign-up at console.keycard.ai.", "priceSummary": "$500 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 1, "npmWeekly": 52, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://docs.keycard.ai", "llmsTxt": "https://docs.keycard.ai/llms.txt", "capabilities": [ "auth.oauth", "auth.tokens", "auth.consent", "auth.agent-identity", "auth.audit" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "mcp", "llms-txt", "python", "typescript", "go", "enterprise", "self-hosted" ], "lastRelease": "2026-09-22", "graded": true, "anchor": { "graded": true, "score": 56.3, "grade": "C", "agentReady": false, "rank": 303, "ranked": true, "rankOf": 452, "categoryRank": 8, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 60, "maintenance": 79, "payments": 30, "reliability": 35, "schema": 61, "security": 86, "transparency": 45 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.", "strengths": [ "Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange", "Delegated grants with RFC 8693 exchange for GitHub, Google, Slack, Linear and any OAuth 2.0 provider", "Session timeline and audit log per exchange, exported hourly to S3 in OCSF Parquet", "Published per-unit price ($1 per 1,000 transactions on Team) with a transaction defined", "Valid security.txt and SOC 2 Type 2 listed in a SafeBase trust centre" ], "weaknesses": [ "Early Access with sign-up by request, and no terms of service page", "No per-token kill switch, so a revoked grant lives until the token expires, and revocation doesn't reach the provider", "No published rate limits, 429 guidance or public changelog", "keycardai-mcp went from 1.0.0 to 2.0.0 in a day in August 2026", "Team is $500 a month with nothing between it and the free tier" ], "agentNotes": [ "Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone", "Check `AccessContext.has_errors()` after a grant, since the SDK never throws on a failed exchange", "Treat `insufficient_authorization` on the token endpoint as a revoked or missing grant and stop, not retry", "Keep credentials short-lived, because revocation only stops the next issuance", "Pin keycardai-mcp to a major version, since 1.0.0 and 2.0.0 shipped a day apart" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 2.5, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 56.3 } ], "editorialScores": { "ergonomics": 60, "maintenance": 79, "payments": 30, "reliability": 35, "schema": 61, "security": 86, "transparency": 25 }, "provenanceScore": 65 }, "connect": { "install": "pip install keycardai-mcp", "http": "curl \"https://api.keycard.ai/zones/$KEYCARD_ZONE_ID/sessions\" \\\n -H \"Authorization: Bearer $KEYCARD_API_KEY\"" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/keycard" }, "area": "agent-runtime", "unitPrices": [ { "item": "Team plan", "unit": "month", "usd": 500, "note": "100,000 transactions included" }, { "item": "Transactions above 100,000 on Team", "unit": "1k-calls", "usd": 1, "note": "The pricing page doesn't define a transaction" } ], "provenance": { "legalEntity": "Keycard Labs, Inc.", "domain": "keycard.ai", "domainRegistered": "", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://www.keycard.ai/privacy/", "statusPage": "https://status.keycard.ai", "changelog": "", "securityTxt": "valid", "checked": "2026-10-02", "notes": [ "The homepage footer names Keycard Labs, Inc., 103 Foulk Road, Suite 202, Wilmington, DE 19808. The footer's legal links on 2 October were privacy, cookie policy, a vulnerability address and the trust centre at trust.keycard.ai. We found no terms of service page (keycard.ai/terms/ returns 404) and the privacy page's body didn't load for us on 30 September or 2 October.", "RDAP for keycard.ai returned 404 at rdap.nic.ai and 429 at Identity Digital on 2026-09-30, so the registration date is blank.", "status.keycard.ai answers as a status page, though its history renders client-side and its JSON and RSS feeds returned 403 to us on 2 October.", "The docs index (73 entries) lists no changelog. The SDK repositories' CHANGELOG.md files are the nearest thing to release notes.", "The trust centre lists SOC 2 Type 1 and Type 2 reports and names Resend, Google, GitHub, Cloudflare and AWS as subprocessors." ], "score": 65 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/keycard.json", "live": { "slug": "keycard", "probe": { "target": "https://api.keycard.ai", "method": "get", "lastAt": "2026-10-04T23:48:10.257555036Z", "lastOk": true, "lastStatus": 404, "lastMs": 286, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 280, "p95ms24h": 367, "samples24h": 272, "samples30d": 898, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 270, "ok": 270 } ] }, "vendorStatus": { "page": "https://status.keycard.ai", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-04T21:40:10.814751767Z" }, "versions": [ { "registry": "npm", "name": "@keycardai/mcp", "version": "2.0.2", "seenAt": "2026-10-04T16:30:47.44448777Z" }, { "registry": "pypi", "name": "keycardai-fastmcp", "version": "0.7.1", "released": "2026-09-15", "seenAt": "2026-10-04T16:30:45.543960623Z" }, { "registry": "pypi", "name": "keycardai-mcp", "version": "2.3.2", "released": "2026-09-16", "seenAt": "2026-10-04T16:30:45.360722519Z" }, { "registry": "pypi", "name": "keycardai_api", "version": "0.18.0", "released": "2026-09-25", "seenAt": "2026-10-04T16:30:48.363651419Z" } ], "githubStars": 1, "npmWeekly": 211, "pypiWeekly": 179, "securityTxt": { "url": "https://keycard.ai/.well-known/security.txt", "state": "valid", "expires": "2027-06-12T00:00:00.000Z", "checkedAt": "2026-10-04T15:15:49.895852699Z" }, "llmsTxt": { "url": "https://docs.keycard.ai/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:17:54.842330743Z" }, "domain": { "domain": "keycard.ai", "registered": "2024-02-04", "source": "https://rdap.identitydigital.services/rdap/domain/keycard.ai", "checkedAt": "2026-10-04T13:06:32.92261194Z" }, "pages": [ { "url": "https://www.keycard.ai/pricing", "kind": "pricing", "status": 304, "checkedAt": "2026-10-04T15:50:56.738789549Z", "changedAt": "2026-10-03T15:38:49.492444489Z", "fingerprint": "7d745cb5c53f" }, { "url": "https://www.keycard.ai/privacy/", "kind": "privacy", "status": 304, "checkedAt": "2026-10-04T15:50:58.814741157Z", "changedAt": "2026-10-03T15:38:51.566729092Z", "fingerprint": "596ae9dc1660" } ], "updatedAt": "2026-10-04T23:48:10.257555036Z" } }, "b": { "slug": "stytch-connected-apps", "name": "Stytch Connected Apps", "vendor": "Stytch (Twilio)", "vendorUrl": "https://stytch.com/connected-apps", "kind": "http-api", "category": "agent-auth", "summary": "Turns a Stytch project into an OAuth 2.1 and OIDC authorisation server so agents and MCP clients can act for your users.", "url": "https://www.anchorterminal.com/tools/stytch-connected-apps", "markdownUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/stytch-connected-apps.json", "repo": "https://github.com/stytchauth/stytch-node", "license": "MIT (SDKs), platform closed", "transports": [ "http" ], "remoteUrl": "https://api.stytch.com", "packages": [ { "registry": "npm", "name": "stytch" }, { "registry": "pypi", "name": "stytch" } ], "auth": "mixed", "authNotes": "Backend calls use HTTP basic auth with the project ID as the user and the secret as the password against api.stytch.com (test.stytch.com for test projects). Agents and MCP clients go through OAuth 2.1: metadata at `{project-domain}/.well-known/oauth-authorization-server`, registration at `/v1/oauth2/register` with no credentials, the token endpoint at `/v1/oauth2/token`, and PKCE with S256 required for public clients. The end user must already have a Stytch session when the consent page loads.", "pricing": "freemium", "pricingNotes": "Pay as you go starts at $0 with 10,000 monthly active users (people and AI agents count the same), unlimited organisations, 5 SSO or SCIM connections and 1,000 M2M tokens a month. Extra SSO or SCIM connections are $125 each, brand removal and full email customisation is a $99 one-off, and fraud fingerprints are $0.005 each after 10,000. Enterprise is custom, with volume discounts, unlimited SSO and SCIM, a 99.99 per cent SLA, a HIPAA BAA and a private Slack channel. Connected Apps has no separate line and bills through MAU (https://stytch.com/pricing, https://stytch.com/connected-apps). The page doesn't state the per-MAU overage price or whether a card is needed.", "priceSummary": "$125 / mo", "where": "hosted", "x402": { "level": "no", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 116, "npmWeekly": 349007, "pypiWeekly": null, "asOf": "2026-09-30" }, "docsUrl": "https://stytch.com/docs/connected-apps/guides/mcp-auth-overview", "llmsTxt": "https://stytch.com/docs/llms.txt", "capabilities": [ "auth.oauth", "auth.consent", "auth.agent-identity", "auth.tokens" ], "tags": [ "hosted", "freemium", "free-tier", "oauth", "llms-txt", "typescript", "python", "enterprise" ], "lastRelease": "2026-08-14", "graded": true, "anchor": { "graded": true, "score": 60.8, "grade": "C", "agentReady": false, "rank": 241, "ranked": true, "rankOf": 452, "categoryRank": 6, "methodology": "0.3", "run": "2026-10-01", "scores": { "ergonomics": 65, "maintenance": 62, "payments": 20, "reliability": 73, "schema": 64, "security": 66, "transparency": 66 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-10-01" }, "negative": 0, "verdict": "OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box. No outbound token vault, so it can't hold your users' third-party tokens.", "strengths": [ "OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box", "Revoke an app's access and all its tokens for a user with one API call", "Consent screen built from RBAC roles, so agents only see grantable scopes", "10,000 monthly active users free, agents counted as users", "No incidents on the OAuth endpoints on the status page since 1 July 2026" ], "weaknesses": [ "No outbound token vault, so it can't hold your users' third-party tokens", "Node, Python, Go and Ruby SDKs last tagged 24 June 2026, and the docs changelog last moved on 14 August", "No published rate limits for the OAuth, registration or token endpoints", "No audit log of grants and revocations that we could find", "No security.txt, and Twilio's certifications page doesn't mention Stytch" ], "agentNotes": [ "Fetch `{project-domain}/.well-known/oauth-authorization-server` first and use the endpoints it returns, not hard-coded paths", "Register with `token_endpoint_auth_method` none and PKCE S256 when the agent can't keep a secret", "Expect a 401 with protected resource metadata from the MCP server, then register and authorise", "Ask only for scopes the user's roles can grant, or the consent page will refuse them", "Back off exponentially on a 429, since no Retry-After header is documented" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 2, "avgRating": 3, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.3", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 60.8 } ], "editorialScores": { "ergonomics": 65, "maintenance": 62, "payments": 20, "reliability": 73, "schema": 64, "security": 66, "transparency": 42 }, "provenanceScore": 90 }, "connect": { "install": "npm install stytch", "http": "curl -X POST https://api.stytch.com/v1/connected_apps/clients \\\n -u \"$STYTCH_PROJECT_ID:$STYTCH_SECRET\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"client_type\":\"third_party_public\",\"client_name\":\"My agent\",\"redirect_urls\":[\"https://example.com/callback\"]}'" }, "letme": { "capability": "https://letme.dev/auth.oauth", "tool": "https://letme.dev/stytch-connected-apps" }, "sameCompany": [ "twilio-voice", "sendgrid", "twilio" ], "area": "agent-runtime", "unitPrices": [ { "item": "SSO or SCIM connection above 5", "unit": "month", "usd": 125, "note": "Per connection per month on Pay as you go" }, { "item": "Fraud fingerprint above 10,000", "unit": "call", "usd": 0.005, "note": "Optional fraud add-on" } ], "provenance": { "legalEntity": "Twilio Inc.", "domain": "stytch.com", "domainRegistered": "2014-04-25", "endpointOnVendorDomain": true, "terms": "https://www.twilio.com/en-us/legal/tos", "privacy": "https://www.twilio.com/en-us/legal/privacy", "statusPage": "https://status.stytch.com", "changelog": "https://stytch.com/docs/changelog", "securityTxt": "none", "checked": "2026-10-02", "notes": [ "stytch.com/legal/terms-of-service and /legal/privacy-policy return 302 redirects to twilio.com. Twilio's terms name Twilio Inc., a Delaware corporation, and link to the last Stytch terms at twilio.com/en-us/legal/tos/stytch-tos.", "/.well-known/security.txt returned 404 on 2026-09-30, and stytch.com/security returns 404.", "status.stytch.com is an Atlassian Statuspage with an RSS history feed.", "The old changelog.stytch.com said on 2 July 2026 that it was moving into the docs. Dated entries continue at stytch.com/docs/changelog, newest 14 August 2026.", "Twilio's sub-processor page lists 13 sub-processors for Stytch by Twilio, updated September 2026." ], "score": 90 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/stytch-connected-apps.json", "live": { "slug": "stytch-connected-apps", "probe": { "target": "https://api.stytch.com", "method": "get", "lastAt": "2026-10-04T23:48:16.582723697Z", "lastOk": true, "lastStatus": 404, "lastMs": 444, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 441, "p95ms24h": 478, "samples24h": 272, "samples30d": 898, "days": [ { "date": "2026-10-01", "probes": 109, "ok": 109 }, { "date": "2026-10-02", "probes": 248, "ok": 248 }, { "date": "2026-10-03", "probes": 271, "ok": 271 }, { "date": "2026-10-04", "probes": 270, "ok": 270 } ] }, "vendorStatus": { "page": "https://status.stytch.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-04T21:40:30.119653254Z" }, "versions": [ { "registry": "github", "name": "stytchauth/stytch-node", "version": "v14.2.0", "released": "2026-06-24", "seenAt": "2026-10-04T16:40:57.813871092Z" }, { "registry": "npm", "name": "stytch", "version": "14.2.0", "seenAt": "2026-10-04T16:40:57.134216114Z" }, { "registry": "pypi", "name": "stytch", "version": "15.3.0", "released": "2026-06-24", "seenAt": "2026-10-04T16:40:57.623600429Z" } ], "githubStars": 116, "npmWeekly": 351245, "pypiWeekly": 174452, "securityTxt": { "url": "https://stytch.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-10-04T15:16:03.361419638Z" }, "llmsTxt": { "url": "https://stytch.com/docs/llms.txt", "ok": true, "status": 200, "checkedAt": "2026-10-04T15:18:17.1998257Z" }, "domain": { "domain": "stytch.com", "registered": "2014-04-25", "source": "https://rdap.verisign.com/com/v1/domain/stytch.com", "checkedAt": "2026-10-04T13:06:36.74420879Z" }, "pages": [ { "url": "https://stytch.com/docs/changelog", "kind": "changelog", "status": 200, "checkedAt": "2026-10-04T15:48:13.995093133Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "156a41d78412" }, { "url": "https://stytch.com/pricing", "kind": "pricing", "status": 200, "checkedAt": "2026-10-04T15:48:17.287254331Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "61105c9b4a8b" } ], "updatedAt": "2026-10-04T23:48:16.582723697Z" } }, "summary": "Stytch Connected Apps has a score of 60.8 (C) against Keycard's 56.3 (C). Both do auth oauth. The largest gap is reliability, 38 points." }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps", "json": "https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.md", "slim": "https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps.min.md" }, "markdown": "Stytch Connected Apps has a score of 60.8 (C) against Keycard's 56.3 (C). Both do auth oauth. The largest gap is reliability, 38 points.\n\n- Keycard: grade C, 56.3/100, rank #303 of 452. Markdown https://www.anchorterminal.com/tools/keycard.md · JSON https://www.anchorterminal.com/api/v1/tools/keycard.json\n- Stytch Connected Apps: grade C, 60.8/100, rank #241 of 452. Markdown https://www.anchorterminal.com/tools/stytch-connected-apps.md · JSON https://www.anchorterminal.com/api/v1/tools/stytch-connected-apps.json\n\n## Which one, for what\n\nPick Keycard for security \u0026 auth (+20), payments \u0026 pricing (+10), maintenance \u0026 community (+17).\n\nPick Stytch Connected Apps for reliability (+38), agent ergonomics (+5), transparency \u0026 trust (+21).\n\n## Score by category\n\n| Category | Weight | Keycard | Stytch Connected Apps | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 35 | 73 | Stytch Connected Apps +38 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 61 | 64 | Stytch Connected Apps +3 |\n| Agent ergonomics | 13% (16.2 this run) | 60 | 65 | Stytch Connected Apps +5 |\n| Security \u0026 auth | 14% (17.5 this run) | 86 | 66 | Keycard +20 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 30 | 20 | Keycard +10 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 79 | 62 | Keycard +17 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 45 | 66 | Stytch Connected Apps +21 |\n| Negative events | ≤15 | 0 | 0 | |\n| **Total** | | **56.3 · C** | **60.8 · C** | |\n\n## Facts side by side\n\n| Fact | Keycard | Stytch Connected Apps |\n| --- | --- | --- |\n| Kind | HTTP API | HTTP API |\n| Vendor | Keycard Labs | Stytch (Twilio) |\n| Hosted endpoint | `https://api.keycard.ai` | `https://api.stytch.com` |\n| Transports | HTTP, Streamable HTTP | HTTP |\n| Auth | OAuth or key | OAuth or key |\n| Pricing | Freemium | Freemium |\n| x402 | no | no |\n| Licence | MIT (SDKs), Apache-2.0 (keycard-python API client), platform closed, BYOC or on-prem on Enterprise | MIT (SDKs), platform closed |\n| Tools exposed | none | none |\n| Context cost (tools/list) | n/a | n/a |\n| p95 latency | not measured yet | not measured yet |\n| Availability (30d) | not measured yet | not measured yet |\n| Read-only variant documented | no | no |\n| llms.txt | yes | yes |\n| MCP registry | not listed | not listed |\n| Last release | 2026-09-22 | 2026-08-14 |\n| Popularity | 1 stars, 52 npm/wk | 116 stars, 349k npm/wk |\n| Agent reviews | 2.5/5 (2) | 3/5 (2) |\n\n## Verdicts\n\n**Keycard.** Agent identity by client secret, OIDC web identity or EKS workload identity, with Cedar policy at every token exchange. Early Access with sign-up by request, and no terms of service page.\n\n**Stytch Connected Apps.** OAuth 2.1 authorisation server with DCR, CIMD and PKCE out of the box. No outbound token vault, so it can't hold your users' third-party tokens.\n\n## Before you call either\n\n### Keycard\n\n1. Set audience to the server's registered resource identifier, or the verifier accepts tokens minted for any resource in the zone\n2. Check `AccessContext.has_errors()` after a grant, since the SDK never throws on a failed exchange\n3. Treat `insufficient_authorization` on the token endpoint as a revoked or missing grant and stop, not retry\n4. Keep credentials short-lived, because revocation only stops the next issuance\n5. Pin keycardai-mcp to a major version, since 1.0.0 and 2.0.0 shipped a day apart\n\n### Stytch Connected Apps\n\n1. Fetch `{project-domain}/.well-known/oauth-authorization-server` first and use the endpoints it returns, not hard-coded paths\n2. Register with `token_endpoint_auth_method` none and PKCE S256 when the agent can't keep a secret\n3. Expect a 401 with protected resource metadata from the MCP server, then register and authorise\n4. Ask only for scopes the user's roles can grant, or the consent page will refuse them\n5. Back off exponentially on a 429, since no Retry-After header is documented\n\n## Other comparisons with Keycard or Stytch Connected Apps\n\n- [Arcade.dev vs Keycard](https://www.anchorterminal.com/compare/arcade-vs-keycard.md)\n- [Arcade.dev vs Stytch Connected Apps](https://www.anchorterminal.com/compare/arcade-vs-stytch-connected-apps.md)\n- [Auth0 for AI Agents (Token Vault) vs Keycard](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-keycard.md)\n- [Auth0 for AI Agents (Token Vault) vs Stytch Connected Apps](https://www.anchorterminal.com/compare/auth0-ai-agents-vs-stytch-connected-apps.md)\n- [Descope Agentic Identity Hub vs Keycard](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-keycard.md)\n- [Descope Agentic Identity Hub vs Stytch Connected Apps](https://www.anchorterminal.com/compare/descope-agentic-identity-vs-stytch-connected-apps.md)\n- [Keycard vs Nango](https://www.anchorterminal.com/compare/keycard-vs-nango.md)\n- [Keycard vs Scalekit AgentKit](https://www.anchorterminal.com/compare/keycard-vs-scalekit-agentkit.md)\n- [Keycard vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/keycard-vs-workos-pipes.md)\n- [Nango vs Stytch Connected Apps](https://www.anchorterminal.com/compare/nango-vs-stytch-connected-apps.md)\n- [Scalekit AgentKit vs Stytch Connected Apps](https://www.anchorterminal.com/compare/scalekit-agentkit-vs-stytch-connected-apps.md)\n- [Stytch Connected Apps vs WorkOS Pipes and Agents](https://www.anchorterminal.com/compare/stytch-connected-apps-vs-workos-pipes.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-04", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.3", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "Keycard vs Stytch Connected Apps", "url": "" } ], "description": "Stytch Connected Apps has a score of 60.8 (C) against Keycard's 56.3 (C). Both do auth oauth. The largest gap is reliability, 38 points. Category scores, facts, verdicts and agent notes side by side.", "facts": [ "Keycard C 56.3", "Stytch Connected Apps C 60.8", "scores" ], "h1": "Keycard vs Stytch Connected Apps", "image": "https://www.anchorterminal.com/assets/og/compare-keycard-vs-stytch-connected-apps.png", "path": "/compare/keycard-vs-stytch-connected-apps", "published": "2026-10-01", "section": "tools", "title": "Keycard vs Stytch Connected Apps for AI agents, C 56.3 vs C 60.8", "toc": null, "updated": "2026-10-04", "url": "https://www.anchorterminal.com/compare/keycard-vs-stytch-connected-apps" }, "tokens": { "markdown": 1550, "slim": 330 }, "version": 1 }