Auth & Identity arenaAuth & Identity
Customer identity and auth platforms for sign-up, sign-in, sessions, and multi-tenant access control, judged on OAuth/OIDC depth, session security, MFA and SSO coverage, organizations and RBAC, migration paths, deployment control, and — critically for the agent era — whether AI agents can authenticate safely with scoped machine identities of their own.
56 user stories · 280 judged cells · updated 2026-09-16 · Evidence as of 2026-09-16
Leaderboard — every product ranked by evidenceLeaderboard
Rank by
| 1 |  Auth0free-tier vs Clerk ↗ | 61/100 | 23/100 | 0/100 | 17/100 | 47/100 | ★ 119▲ 83/yrnpm 1.4M/wk | 12/41 verified | 24/100 integrity | ||
| 2 |  Clerkfree-tier vs Auth0 ↗ | 66/100 | 9/100 | 26/100 | 12/100 | 24/100 | ★ 1.8k▲ 370/yrnpm 1.8M/wk | 13/39 verified · 2 disputed | 17/100 integrity | ||
| 3 |  Better Authvs Auth0 ↗ | 57/100 | 10/100 | 0/100 | 63/100 | 0/100 | ★ 29.9k▲ 12.9k/yrnpm 6.2M/wk | 22/36 verified | 45/100 integrity | ||
| 4 |  WorkOSfree-tier vs Auth0 ↗ | 59/100 | 8/100 | 0/100 | 16/100 | 7/100 | ★ 221▲ 30/yrnpm 2.1M/wk | 12/33 verified | 33/100 integrity | ||
| 5 |  Keycloaksupport-contracts vs Auth0 ↗ | 27/100 | untested | 9/100 | 44/100 | 23/100 | ★ 36.8k▲ 2.8k/yrnpm 739.4k/wk | 10/36 verified · 2 disputed | 35/100 integrity |
Best by user type — persona-weighted winnersBest by user type
Per persona, the product with the highest persona-weighted coverage over just that persona's stories — not the same ranking as the overall PA Score leaderboard above.
Story matrix — every product × every judged storyStory matrix
56/56 stories shown · legend
Agent auth — stories about agent auth in this arenaAgent auth
Delegation
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Agent auth — stories about agent auth in this arenaRequire asynchronous human approval (e.g. CIBA-style confirmation) before an autonomous agent completes a sensitive transaction | ai-native | fullC 8/10 | partialC 3/10 | none 0/10 | none 0/10 | none 0/10 |
| Agent auth — stories about agent auth in this arenaHave an agent obtain short-lived, user-consented tokens for third-party APIs (token vault/exchange) so tool calls run under the user's delegated authority | ai-native | fullC 8/10 | partialC 6/10 | partialC 4/10 | partialC 4/10 | partialC 4/10 |
Device flow
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Agent auth — stories about agent auth in this arenaAuthenticate CLIs and headless agents via the OAuth device authorization flow instead of pasting long-lived secrets | ai-native | fullT 8/10 | partialC 6/10 | fullC 9/10 | fullC 9/10 | fullC 8/10 |
Machine identity
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Agent auth — stories about agent auth in this arenaIssue machine-to-machine credentials (client-credentials flow) so backend services and agents authenticate without a human in the loop | ai-native | fullC 9/10 | fullC 7/10 | fullC 8/10 | fullC 9/10 | partialC 5/10 |
| Agent auth — stories about agent auth in this arenaGive each agent its own least-privilege machine identity with narrowly scoped permissions and instant revocation, instead of sharing a human's credentials | ai-native | fullC 7/10 | partialC 7/10 | partialC 5/10 | partialC 6/10 | partialC 6/10 |
Mcp
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Agent auth — stories about agent auth in this arenaPut a spec-compliant OAuth authorization flow in front of my MCP server so remote agents connect with scoped, verifiable tokens | ai-native | partialC 5/10 | partialC 6/10 | fullT 8/10 | partialC 6/10 | fullT 8/10 |
Agenticness — how well agents can access and operate the productAgenticness
Agent access
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Agenticness — how well agents can access and operate the productPoint an agent at llms.txt or agent-oriented docs | ai-native | fullT 9/10 | fullT 9/10 | fullT 9/10 | none 0/10 | fullT 9/10 |
| Agenticness — how well agents can access and operate the productRun the product headlessly / in CI for automation | ai-native | partialT 6/10 | partialT 5/10 | partialT 5/10 | disputedD 4/10 | partialT 5/10 |
| Agenticness — how well agents can access and operate the productPlug MCP servers into this product so it can use their tools | ai-native | partialC 5/10 | none 0/10 | n/a | n/a | n/a |
| Agenticness — how well agents can access and operate the productConnect an agent via an official MCP server | ai-native | fullT 9/10 | fullT 9/10 | fullT 8/10 | none 0/10 | fullT 8/10 |
| Agenticness — how well agents can access and operate the productUse an official CLI | ai-native | fullT 7/10 | fullT 8/10 | partialC 3/10 | fullC 7/10 | fullT 8/10 |
| Agenticness — how well agents can access and operate the productDrive the product through a documented public API | ai-native | fullT 8/10 | fullT 8/10 | fullT 9/10 | fullX 8/10 | fullT 8/10 |
| Agenticness — how well agents can access and operate the productIssue scoped/least-privilege API credentials for an agent | ai-native | fullC 8/10 | fullC 8/10 | partialC 6/10 | partialC 7/10 | partialT 6/10 |
| Agenticness — how well agents can access and operate the productBuild against official SDKs | ai-native | partialC 6/10 | fullT 8/10 | fullC 7/10 | none 0/10 | partialT 6/10 |
| Agenticness — how well agents can access and operate the productSubscribe to events via webhooks | ai-native | partialC 5/10 | fullC 8/10 | partialC 5/10 | none 0/10 | none 0/10 |
Agentic features
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Agenticness — how well agents can access and operate the productGet AI-generated insights and suggestions from my data inside the product | ai-native | none 0/10 | n/a | none 0/10 | n/a | n/a |
| Agenticness — how well agents can access and operate the productSet up automations that run autonomously in the background | ai-native | partialC 4/10 | none 0/10 | none 0/10 | n/a | n/a |
| Agenticness — how well agents can access and operate the productDelegate tasks to a built-in AI assistant inside the product | ai-native | none 0/10 | none 0/10 | none 0/10 | none 0/10 | none 0/10 |
| Agenticness — how well agents can access and operate the productOperate the product with natural-language commands | ai-native | fullT 8/10 | partialT 5/10 | partialT 6/10 | n/a | partialT 4/10 |
Api quality
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Agenticness — how well agents can access and operate the productExplore an interactive API reference with runnable examples | ai-native | none 0/10 | none 0/10 | none 0/10 | none 0/10 | none 0/10 |
| Agenticness — how well agents can access and operate the productDownload a machine-readable API spec (OpenAPI or equivalent) | ai-native | none 0/10 | fullT 9/10 | none 0/10 | partialT 4/10 | none 0/10 |
| Agenticness — how well agents can access and operate the productTest against a sandbox environment without touching production data | ai-native | none 0/10 | none 0/10 | none 0/10 | disputedD 4/10 | none 0/10 |
| Agenticness — how well agents can access and operate the productRely on versioned APIs with a documented deprecation policy | ai-native | none 0/10 | none 0/10 | none 0/10 | none 0/10 | none 0/10 |
Automation depth — how much of the product can run unattendedAutomation depth
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Automation depth — how much of the product can run unattendedPerform bulk operations across many items at once | ai-native | partialC 4/10 | partialC 4/10 | partialC 3/10 | partialX 5/10 | none 0/10 |
| Automation depth — how much of the product can run unattendedDefine rules that trigger actions automatically on events | ai-native | fullC 7/10 | partialC 4/10 | none 0/10 | partialC 3/10 | none 0/10 |
| Automation depth — how much of the product can run unattendedSchedule recurring jobs or workflows | ai-native | n/a | n/a | n/a | n/a | n/a |
| Automation depth — how much of the product can run unattendedVersion, review, and roll back my automations | ai-native | partialC 4/10 | n/a | n/a | n/a | n/a |
Deployment control — stories about deployment control in this arenaDeployment control
Deployment
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Deployment control — stories about deployment control in this arenaControl where the auth system and its user data run — self-managed deployment, private instance, or my own database | security-engineer | partialC 4/10 | none 0/10 | none 0/10 | fullX 9/10 | fullX 9/10 |
Enterprise sso — stories about enterprise sso in this arenaEnterprise sso
Sso
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Enterprise sso — stories about enterprise sso in this arenaConnect enterprise identity providers over SAML and OIDC (Okta, Entra, Google Workspace) for workforce sign-in | security-engineer | fullC 7/10 | fullC 8/10 | fullX 9/10 | fullX 7/10 | fullC 6/10 |
| Enterprise sso — stories about enterprise sso in this arenaSync users and groups from customer directories via SCIM so deprovisioning in the IdP revokes app access | security-engineer | partialC 3/10 | none 0/10 | fullX 9/10 | partialC 6/10 | none 0/10 |
Events webhooks — stories about events webhooks in this arenaEvents webhooks
Audit
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Events webhooks — stories about events webhooks in this arenaCapture tamper-evident audit logs of authentication and admin activity and stream or export them to my SIEM | security-engineer | partialC 6/10 | disputedD 3/10 | partialC 6/10 | none 0/10 | none 0/10 |
Webhooks
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Events webhooks — stories about events webhooks in this arenaSubscribe to webhooks or event streams for auth events (sign-ups, sign-ins, user changes) to keep my systems in sync | developer | partialC 5/10 | fullC 7/10 | partialC 5/10 | none 0/10 | none 0/10 |
Framework integration — stories about framework integration in this arenaFramework integration
Frameworks
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Framework integration — stories about framework integration in this arenaProtect routes with first-party framework SDKs and middleware (Next.js and peers) that verify sessions at the edge | developer | none 0/10 | partialX 6/10 | none 0/10 | none 0/10 | partialT 5/10 |
| Framework integration — stories about framework integration in this arenaShip production sign-in, sign-up, and profile management with prebuilt, customizable UI components or hosted pages | developer | fullX 7/10 | fullC 8/10 | fullX 7/10 | fullC 7/10 | none 0/10 |
Mfa passwordless — stories about mfa passwordless in this arenaMfa passwordless
Hardening
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Mfa passwordless — stories about mfa passwordless in this arenaRely on built-in protection against bots, credential stuffing, and brute-force attacks on the auth flows | security-engineer | fullC 7/10 | fullC 8/10 | partialC 6/10 | fullX 8/10 | partialC 6/10 |
Mfa
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Mfa passwordless — stories about mfa passwordless in this arenaRequire multi-factor authentication with TOTP authenticator apps and backup codes, with step-up enforcement where needed | security-engineer | fullC 7/10 | fullC 8/10 | partialC 4/10 | partialC 4/10 | partialC 7/10 |
Passwordless
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Mfa passwordless — stories about mfa passwordless in this arenaOffer passkeys/WebAuthn and passwordless options like magic links or email OTP as first-class sign-in methods | developer | fullC 8/10 | partialC 6/10 | fullC 8/10 | partialC 6/10 | fullX 8/10 |
Oauth oidc — stories about oauth oidc in this arenaOauth oidc
Flows
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Oauth oidc — stories about oauth oidc in this arenaImplement standard OAuth 2.0 / OIDC flows (authorization code with PKCE, refresh tokens) without hand-rolling protocol details | developer | fullX 7/10 | partialC 6/10 | partialC 6/10 | fullX 9/10 | fullC 7/10 |
| Oauth oidc — stories about oauth oidc in this arenaOffer sign-in with a broad set of social and OAuth identity providers through configuration, not custom code | developer | fullC 7/10 | partialC 6/10 | fullX 8/10 | fullX 8/10 | fullX 8/10 |
Provider
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Oauth oidc — stories about oauth oidc in this arenaTurn my own application into an OAuth provider that issues tokens to third-party clients ("Sign in with my app") | developer | partialC 5/10 | partialC 5/10 | fullC 8/10 | fullC 8/10 | fullT 7/10 |
Openness — open source, data portability, and self-hosting storiesOpenness
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Openness — open source, data portability, and self-hosting storiesDo everything through the API that I can do in the UI | ai-native | partialT 7/10 | partialT 6/10 | fullT 8/10 | partialT 7/10 | fullT 7/10 |
| Openness — open source, data portability, and self-hosting storiesExport all of my data in open formats and leave | ai-native | partialX 5/10 | none 0/10 | none 0/10 | partialC 5/10 | partialX 6/10 |
| Openness — open source, data portability, and self-hosting storiesRead the product's source under an open license | ai-native | none 0/10 | partialC 4/10 | none 0/10 | none 0/10 | fullX 7/10 |
| Openness — open source, data portability, and self-hosting storiesSelf-host the core product | ai-native | none 0/10 | none 0/10 | none 0/10 | fullX 9/10 | fullX 8/10 |
Orgs multitenant — stories about orgs multitenant in this arenaOrgs multitenant
Orgs
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Orgs multitenant — stories about orgs multitenant in this arenaGive each customer organization its own SSO connection with verified domains and just-in-time provisioning | security-engineer | partialC 6/10 | partialC 5/10 | partialC 5/10 | partialC 4/10 | partialC 5/10 |
| Orgs multitenant — stories about orgs multitenant in this arenaModel multi-tenant B2B apps with organizations, memberships, and invitation flows out of the box | developer | partialC 6/10 | fullX 8/10 | partialC 6/10 | partialC 6/10 | partialX 6/10 |
Privacy posture — data-handling and privacy storiesPrivacy posture
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Privacy posture — data-handling and privacy storiesChoose where my data is stored (region/residency) | ai-native | partialC 4/10 | none 0/10 | none 0/10 | partialC 4/10 | partialX 5/10 |
| Privacy posture — data-handling and privacy storiesPrevent my data from being used to train AI models | ai-native | n/a | none 0/10 | n/a | n/a | n/a |
| Privacy posture — data-handling and privacy storiesControl data retention and deletion | ai-native | none 0/10 | none 0/10 | none 0/10 | partialC 3/10 | partialX 4/10 |
| Privacy posture — data-handling and privacy storiesOpt out of telemetry and usage tracking | ai-native | none 0/10 | none 0/10 | n/a | none 0/10 | none 0/10 |
Rbac permissions — stories about rbac permissions in this arenaRbac permissions
Rbac
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Rbac permissions — stories about rbac permissions in this arenaExpress fine-grained, resource-level authorization (relationship- or policy-based) beyond simple roles | security-engineer | fullC 7/10 | partialX 3/10 | partialC 5/10 | fullC 9/10 | partialC 4/10 |
| Rbac permissions — stories about rbac permissions in this arenaDefine roles and permissions and have them enforced and surfaced in session tokens for authorization checks | developer | fullC 8/10 | partialX 7/10 | fullC 8/10 | fullC 8/10 | partialC 6/10 |
Session management — stories about session management in this arenaSession management
Sessions
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| Session management — stories about session management in this arenaLet users and admins see active sessions and devices and revoke them individually or all at once | security-engineer | none 0/10 | partialC 6/10 | none 0/10 | fullC 7/10 | partialC 5/10 |
| Session management — stories about session management in this arenaManage session lifecycle — expiry, refresh, and immediate server-side revocation of a compromised session | developer | none 0/10 | disputedD 5/10 | none 0/10 | fullC 7/10 | fullC 8/10 |
User migration — stories about user migration in this arenaUser migration
Migration
| Story | Persona | Auth0 | Clerk | WorkOS | Keycloak | Better Auth |
|---|---|---|---|---|---|---|
| User migration — stories about user migration in this arenaBulk-import existing users — including password hashes — and export them again, so I am never locked in | developer | partialX 6/10 | partialC 4/10 | partialX 5/10 | partialC 5/10 | partialX 5/10 |
| User migration — stories about user migration in this arenaFollow vendor-maintained migration guides or tooling for moving off a competing auth provider without forcing password resets | founder | fullC 7/10 | partialC 5/10 | partialC 6/10 | partialC 4/10 | partialC 6/10 |
Verdict✓ fullclear evidence~ partialwith caveats! disputedevidence conflicts— noneno evidence foundn/aquestion doesn't apply to this kind of product
ProofT probedtested by usX communityusers back itC claimedvendor claim onlyD contradictedevidence disagrees⚿ auth-gatedprobe hit a live sign-in wall — verified reachable, untestable keylessly
quality 0–10 · PA Score /100 · A–D = evidence confidence · full guideAdjacent arenas — categories often shopped togetherAdjacent arenas
Shopping this category often means shopping these too.
Backend as a Service arenaBackend as a Service
4 products · leader: Supabase
Feature Flags & Experimentation arenaFeature Flags & Experimentation
5 products · leader: Flagsmith
Processors arenaProcessors
8 products · leader: Intel Core Ultra 7 258V
GPUs & AI Accelerators arenaGPUs & AI Accelerators
8 products · leader: AMD Instinct MI355X