# Cloudflare Workers OAuth Provider (slim)

> Cloudflare Workers OAuth Provider is Cloudflare's open-source TypeScript library that adds OAuth 2.1 authorization to HTTP APIs and remote MCP servers on Cloudflare Workers, as both the authorization server and the resource server.

- Full: https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.md (~7,300 tokens) · this version ~1,380 tokens · JSON https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider.json · canonical https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07 · pricing https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider#pricing · reviews https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**BB · 76.2/100 · rank #47 of 1486 · #4 in Agent auth & delegated access · agent-ready · confidence medium**


Assessment: Cloudflare's MIT library gives a remote MCP server on Workers both sides of OAuth 2.1, with PKCE, resource indicators, step-up scopes, hashed client secrets and encrypted props, at 1.2.4 with a conformance suite. It runs only on Workers with KV, 1.2.0 broke some clients in a minor release, and two open concurrency reports had no reply.

## Facts

- Kind: SDK + MCP · vendor: Cloudflare · category: Agent auth & delegated access · legal entity: Cloudflare, Inc. · provenance 95/100
- Packages: npm `@cloudflare/workers-oauth-provider`
- Auth: OAuth · pricing: Free · x402: no · licence: MIT
- Benchmark probes: not run yet, so Performance is pending
- Vendor status page: a major outage, Partial System Outage (2026-11-07 17:45 UTC)
- Surface listed: The `@cloudflare/workers-oauth-provider` library 1.2.4, read from a clone of github.com/cloudflare/workers-oauth-provider, the npm registry and Cloudflare's MCP authorization page on 6 November 2026. Nothing was installed or deployed
- Not covered elsewhere: No Cloudflare listing covers this library on 6 November 2026; cloudflare-mcp is Cloudflare's own MCP server and cloudflare-sandbox-sdk its sandboxes
- Roles: `OAuthAuthorizationServer` signs users in and issues tokens; `OAuthResourceServer` wraps the MCP endpoint and validates tokens over a Service Binding
- Standards: OAuth 2.1 with PKCE, RFC 9728 protected-resource metadata, resource indicators, token revocation, optional dynamic client registration, Client ID Metadata Documents and private_key_jwt client assertions
- Docs: README, seven Markdown guides (authorization server, resource servers, consent page, upstream sign-in, MCP discovery, advanced configuration, migration to 1.x), a storage schema and an agent skill for migrating
- Legal entity: Cloudflare, Inc., the copyright holder in LICENSE.txt

- Scores: Reliability 74, Performance pending, Schema & documentation 86, Agent ergonomics 74, Security & auth 80, Payments & pricing 50, Task success pending, Maintenance & community 87, Transparency & trust 86 · total over the 7 assessed categories
- Why: Reliability, Local-software lines, as a library the developer deploys. · Schema & documentation, Read as a library. · Agent ergonomics, Framework reading. · Security & auth, OAuth 2.1 with PKCE, scopes, resource indicators, revocation, hashed client secrets and encrypted props (30). · Payments & pricing, Self-hosted rule. · Maintenance & community, 1.2.4 on 22 October 2026 (30). · Transparency & trust, MIT (30).
- Sources: 6, open questions: 6, both in the full twin
- Capabilities: auth.oauth, auth.tokens, auth.consent
- JSON: https://www.anchorterminal.com/api/v1/tools/cloudflare-workers-oauth-provider.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/cloudflare-workers-oauth-provider.svg` or a link to https://www.anchorterminal.com/tools/cloudflare-workers-oauth-provider from a page on cloudflare.com or one of its subdomains, or the README at the root of github.com/cloudflare/workers-oauth-provider, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.
- Support: Discord https://discord.cloudflare.com; https://developers.cloudflare.com/support/contacting-cloudflare-support/; more in the full twin

## Before you call it

1. Request the scopes the resource server lists in `requiredScopes` first, then re-authorize for more when a 403 names a missing scope
2. Send `resource` with the token request; a resource the server doesn't host returns `invalid_target`
3. Use https redirect URIs; remote http redirect URIs have been refused since 1.2.0
4. Treat a revoked token as possibly valid for a short time, since revocation rests on KV's eventual consistency

## Connect

```bash
npm install @cloudflare/workers-oauth-provider
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/cloudflare-workers-oauth-provider

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| Descope Agentic Identity Hub | A | 78.1 | auth.oauth, auth.tokens, auth.consent | https://www.anchorterminal.com/tools/descope-agentic-identity.min.md |
| Amazon Bedrock AgentCore Identity | BB | 76.4 | auth.oauth, auth.tokens, auth.consent | https://www.anchorterminal.com/tools/agentcore-identity.min.md |
| Auth0 for AI Agents (Token Vault) | BB | 74.3 | auth.oauth, auth.tokens, auth.consent | https://www.anchorterminal.com/tools/auth0-ai-agents.min.md |
| Scalekit AgentKit | BB | 72.2 | auth.oauth, auth.tokens, auth.consent | https://www.anchorterminal.com/tools/scalekit-agentkit.min.md |
| Vercel Connect | BB | 70.8 | auth.tokens, auth.oauth, auth.consent | https://www.anchorterminal.com/tools/vercel-connect.min.md |


## Panel reviews (0, desk reviews from public material, no calls made)