Auth & Identity arenaBuyer checklist
Every requirement we judge auth & identity products against, as a ready-to-send RFP checklist — with each item's priority, why it matters, and how the top-ranked products score on it today.
56 requirements · 15 themes · verdicts for 5 products · updated 2026-09-16 · priorities mirror the story weights our scoring uses (methodology)
Show the markdown export
# Auth & Identity — buyer checklist (RFP)
Derived from ProductArena's evidence-graded user-story taxonomy for Auth & Identity: 56 judged requirements. Priorities mirror story weights (3 = must-have, 2 = should-have, 1 = nice-to-have).
## Agent auth
- [ ] **[must-have]** Have an agent obtain short-lived, user-consented tokens for third-party APIs (token vault/exchange) so tool calls run under the user's delegated authority
- [ ] **[must-have]** Issue machine-to-machine credentials (client-credentials flow) so backend services and agents authenticate without a human in the loop
- [ ] **[must-have]** Give each agent its own least-privilege machine identity with narrowly scoped permissions and instant revocation, instead of sharing a human's credentials
- [ ] **[must-have]** Put a spec-compliant OAuth authorization flow in front of my MCP server so remote agents connect with scoped, verifiable tokens
- [ ] **[should-have]** Require asynchronous human approval (e.g. CIBA-style confirmation) before an autonomous agent completes a sensitive transaction
- [ ] **[should-have]** Authenticate CLIs and headless agents via the OAuth device authorization flow instead of pasting long-lived secrets
## Agenticness
- [ ] **[must-have]** Plug MCP servers into this product so it can use their tools
- [ ] **[must-have]** Connect an agent via an official MCP server
- [ ] **[must-have]** Drive the product through a documented public API
- [ ] **[must-have]** Delegate tasks to a built-in AI assistant inside the product
- [ ] **[should-have]** Point an agent at llms.txt or agent-oriented docs
- [ ] **[should-have]** Run the product headlessly / in CI for automation
- [ ] **[should-have]** Use an official CLI
- [ ] **[should-have]** Issue scoped/least-privilege API credentials for an agent
- [ ] **[should-have]** Build against official SDKs
- [ ] **[should-have]** Subscribe to events via webhooks
- [ ] **[should-have]** Get AI-generated insights and suggestions from my data inside the product
- [ ] **[should-have]** Set up automations that run autonomously in the background
- [ ] **[should-have]** Operate the product with natural-language commands
- [ ] **[should-have]** Explore an interactive API reference with runnable examples
- [ ] **[should-have]** Download a machine-readable API spec (OpenAPI or equivalent)
- [ ] **[should-have]** Rely on versioned APIs with a documented deprecation policy
- [ ] **[nice-to-have]** Test against a sandbox environment without touching production data
## Automation depth
- [ ] **[must-have]** Define rules that trigger actions automatically on events
- [ ] **[should-have]** Perform bulk operations across many items at once
- [ ] **[should-have]** Schedule recurring jobs or workflows
- [ ] **[nice-to-have]** Version, review, and roll back my automations
## Deployment control
- [ ] **[should-have]** Control where the auth system and its user data run — self-managed deployment, private instance, or my own database
## Enterprise sso
- [ ] **[must-have]** Connect enterprise identity providers over SAML and OIDC (Okta, Entra, Google Workspace) for workforce sign-in
- [ ] **[should-have]** Sync users and groups from customer directories via SCIM so deprovisioning in the IdP revokes app access
## Events webhooks
- [ ] **[should-have]** Capture tamper-evident audit logs of authentication and admin activity and stream or export them to my SIEM
- [ ] **[should-have]** Subscribe to webhooks or event streams for auth events (sign-ups, sign-ins, user changes) to keep my systems in sync
## Framework integration
- [ ] **[must-have]** Protect routes with first-party framework SDKs and middleware (Next.js and peers) that verify sessions at the edge
- [ ] **[should-have]** Ship production sign-in, sign-up, and profile management with prebuilt, customizable UI components or hosted pages
## Mfa passwordless
- [ ] **[must-have]** Require multi-factor authentication with TOTP authenticator apps and backup codes, with step-up enforcement where needed
- [ ] **[should-have]** Offer passkeys/WebAuthn and passwordless options like magic links or email OTP as first-class sign-in methods
- [ ] **[nice-to-have]** Rely on built-in protection against bots, credential stuffing, and brute-force attacks on the auth flows
## Oauth oidc
- [ ] **[must-have]** Implement standard OAuth 2.0 / OIDC flows (authorization code with PKCE, refresh tokens) without hand-rolling protocol details
- [ ] **[should-have]** Offer sign-in with a broad set of social and OAuth identity providers through configuration, not custom code
- [ ] **[should-have]** Turn my own application into an OAuth provider that issues tokens to third-party clients ("Sign in with my app")
## Openness
- [ ] **[must-have]** Export all of my data in open formats and leave
- [ ] **[must-have]** Self-host the core product
- [ ] **[should-have]** Do everything through the API that I can do in the UI
- [ ] **[should-have]** Read the product's source under an open license
## Orgs multitenant
- [ ] **[must-have]** Model multi-tenant B2B apps with organizations, memberships, and invitation flows out of the box
- [ ] **[should-have]** Give each customer organization its own SSO connection with verified domains and just-in-time provisioning
## Privacy posture
- [ ] **[must-have]** Prevent my data from being used to train AI models
- [ ] **[should-have]** Choose where my data is stored (region/residency)
- [ ] **[should-have]** Control data retention and deletion
- [ ] **[should-have]** Opt out of telemetry and usage tracking
## Rbac permissions
- [ ] **[must-have]** Define roles and permissions and have them enforced and surfaced in session tokens for authorization checks
- [ ] **[nice-to-have]** Express fine-grained, resource-level authorization (relationship- or policy-based) beyond simple roles
## Session management
- [ ] **[must-have]** Manage session lifecycle — expiry, refresh, and immediate server-side revocation of a compromised session
- [ ] **[nice-to-have]** Let users and admins see active sessions and devices and revoke them individually or all at once
## User migration
- [ ] **[should-have]** Bulk-import existing users — including password hashes — and export them again, so I am never locked in
- [ ] **[nice-to-have]** Follow vendor-maintained migration guides or tooling for moving off a competing auth provider without forcing password resets
---
Source: https://ultrametric.ai/productarena/arena/auth-platforms (evidence-graded verdicts for 5 products) · methodology: https://ultrametric.ai/productarena/methodology
Chips show the top 5 ranked products' current verdict on each requirement — ✓ full · ~ partial · ! disputed · — none · n/a not applicable.
Agent auth — stories about agent auth in this arenaAgent auth· 6 items
Stories about agent auth in this arena
- must-have
ai-native userHave an agent obtain short-lived, user-consented tokens for third-party APIs (token vault/exchange) so tool calls run under the user's delegated authority
Core requirement — weighs 3× in arena scoring · 1 of 5 products fully deliver this today
- must-have
ai-native userIssue machine-to-machine credentials (client-credentials flow) so backend services and agents authenticate without a human in the loop
Core requirement — weighs 3× in arena scoring · 4 of 5 products fully deliver this today
- must-have
ai-native userGive each agent its own least-privilege machine identity with narrowly scoped permissions and instant revocation, instead of sharing a human's credentials
Core requirement — weighs 3× in arena scoring · 1 of 5 products fully deliver this today
- must-have
ai-native userPut a spec-compliant OAuth authorization flow in front of my MCP server so remote agents connect with scoped, verifiable tokens
Core requirement — weighs 3× in arena scoring · 2 of 5 products fully deliver this today
- should-have
ai-native userRequire asynchronous human approval (e.g. CIBA-style confirmation) before an autonomous agent completes a sensitive transaction
Important, not disqualifying — weighs 2× in arena scoring · 1 of 5 products fully deliver this today
- should-have
ai-native userAuthenticate CLIs and headless agents via the OAuth device authorization flow instead of pasting long-lived secrets
Important, not disqualifying — weighs 2× in arena scoring · 4 of 5 products fully deliver this today
Agenticness — how well agents can access and operate the productAgenticness· 17 items
How well agents can access and operate the product
- must-have
ai-native userPlug MCP servers into this product so it can use their tools
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
- must-have
ai-native userConnect an agent via an official MCP server
Core requirement — weighs 3× in arena scoring · 4 of 5 products fully deliver this today
- must-have
ai-native userDrive the product through a documented public API
Core requirement — weighs 3× in arena scoring · all 5 products fully deliver this today
- must-have
ai-native userDelegate tasks to a built-in AI assistant inside the product
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
- should-have
ai-native userPoint an agent at llms.txt or agent-oriented docs
Important, not disqualifying — weighs 2× in arena scoring · 4 of 5 products fully deliver this today
- should-have
ai-native userRun the product headlessly / in CI for automation
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userUse an official CLI
Important, not disqualifying — weighs 2× in arena scoring · 4 of 5 products fully deliver this today
- should-have
ai-native userIssue scoped/least-privilege API credentials for an agent
Important, not disqualifying — weighs 2× in arena scoring · 2 of 5 products fully deliver this today
- should-have
ai-native userBuild against official SDKs
Important, not disqualifying — weighs 2× in arena scoring · 2 of 5 products fully deliver this today
- should-have
ai-native userSubscribe to events via webhooks
Important, not disqualifying — weighs 2× in arena scoring · 1 of 5 products fully deliver this today
- should-have
ai-native userGet AI-generated insights and suggestions from my data inside the product
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userSet up automations that run autonomously in the background
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userOperate the product with natural-language commands
Important, not disqualifying — weighs 2× in arena scoring · 1 of 4 products fully deliver this today
- should-have
ai-native userExplore an interactive API reference with runnable examples
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)
Important, not disqualifying — weighs 2× in arena scoring · 1 of 5 products fully deliver this today
- should-have
ai-native userRely on versioned APIs with a documented deprecation policy
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- nice-to-have
ai-native userTest against a sandbox environment without touching production data
Differentiator, not a dealbreaker — weighs 1× in arena scoring · no product fully delivers this yet
Automation depth — how much of the product can run unattendedAutomation depth· 4 items
How much of the product can run unattended
- must-have
ai-native userDefine rules that trigger actions automatically on events
Core requirement — weighs 3× in arena scoring · 1 of 5 products fully deliver this today
- should-have
ai-native userPerform bulk operations across many items at once
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userSchedule recurring jobs or workflows
Important, not disqualifying — weighs 2× in arena scoring
- nice-to-have
ai-native userVersion, review, and roll back my automations
Differentiator, not a dealbreaker — weighs 1× in arena scoring · no product fully delivers this yet
Deployment control — stories about deployment control in this arenaDeployment control· 1 item
Stories about deployment control in this arena
- should-have
security-engineerControl where the auth system and its user data run — self-managed deployment, private instance, or my own database
Important, not disqualifying — weighs 2× in arena scoring · 2 of 5 products fully deliver this today
Enterprise sso — stories about enterprise sso in this arenaEnterprise sso· 2 items
Stories about enterprise sso in this arena
- must-have
security-engineerConnect enterprise identity providers over SAML and OIDC (Okta, Entra, Google Workspace) for workforce sign-in
Core requirement — weighs 3× in arena scoring · all 5 products fully deliver this today
- should-have
security-engineerSync users and groups from customer directories via SCIM so deprovisioning in the IdP revokes app access
Important, not disqualifying — weighs 2× in arena scoring · 1 of 5 products fully deliver this today
Events webhooks — stories about events webhooks in this arenaEvents webhooks· 2 items
Stories about events webhooks in this arena
- should-have
security-engineerCapture tamper-evident audit logs of authentication and admin activity and stream or export them to my SIEM
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
developerSubscribe to webhooks or event streams for auth events (sign-ups, sign-ins, user changes) to keep my systems in sync
Important, not disqualifying — weighs 2× in arena scoring · 1 of 5 products fully deliver this today
Framework integration — stories about framework integration in this arenaFramework integration· 2 items
Stories about framework integration in this arena
- must-have
developerProtect routes with first-party framework SDKs and middleware (Next.js and peers) that verify sessions at the edge
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
- should-have
developerShip production sign-in, sign-up, and profile management with prebuilt, customizable UI components or hosted pages
Important, not disqualifying — weighs 2× in arena scoring · 4 of 5 products fully deliver this today
Mfa passwordless — stories about mfa passwordless in this arenaMfa passwordless· 3 items
Stories about mfa passwordless in this arena
- must-have
security-engineerRequire multi-factor authentication with TOTP authenticator apps and backup codes, with step-up enforcement where needed
Core requirement — weighs 3× in arena scoring · 2 of 5 products fully deliver this today
- should-have
developerOffer passkeys/WebAuthn and passwordless options like magic links or email OTP as first-class sign-in methods
Important, not disqualifying — weighs 2× in arena scoring · 3 of 5 products fully deliver this today
- nice-to-have
security-engineerRely on built-in protection against bots, credential stuffing, and brute-force attacks on the auth flows
Differentiator, not a dealbreaker — weighs 1× in arena scoring · 3 of 5 products fully deliver this today
Oauth oidc — stories about oauth oidc in this arenaOauth oidc· 3 items
Stories about oauth oidc in this arena
- must-have
developerImplement standard OAuth 2.0 / OIDC flows (authorization code with PKCE, refresh tokens) without hand-rolling protocol details
Core requirement — weighs 3× in arena scoring · 3 of 5 products fully deliver this today
- should-have
developerOffer sign-in with a broad set of social and OAuth identity providers through configuration, not custom code
Important, not disqualifying — weighs 2× in arena scoring · 4 of 5 products fully deliver this today
- should-have
developerTurn my own application into an OAuth provider that issues tokens to third-party clients ("Sign in with my app")
Important, not disqualifying — weighs 2× in arena scoring · 3 of 5 products fully deliver this today
Openness — open source, data portability, and self-hosting storiesOpenness· 4 items
Open source, data portability, and self-hosting stories
- must-have
ai-native userExport all of my data in open formats and leave
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
- must-have
ai-native userSelf-host the core product
Core requirement — weighs 3× in arena scoring · 2 of 5 products fully deliver this today
- should-have
ai-native userDo everything through the API that I can do in the UI
Important, not disqualifying — weighs 2× in arena scoring · 2 of 5 products fully deliver this today
- should-have
ai-native userRead the product's source under an open license
Important, not disqualifying — weighs 2× in arena scoring · 1 of 5 products fully deliver this today
Orgs multitenant — stories about orgs multitenant in this arenaOrgs multitenant· 2 items
Stories about orgs multitenant in this arena
- must-have
developerModel multi-tenant B2B apps with organizations, memberships, and invitation flows out of the box
Core requirement — weighs 3× in arena scoring · 1 of 5 products fully deliver this today
- should-have
security-engineerGive each customer organization its own SSO connection with verified domains and just-in-time provisioning
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Privacy posture — data-handling and privacy storiesPrivacy posture· 4 items
Data-handling and privacy stories
- must-have
ai-native userPrevent my data from being used to train AI models
Core requirement — weighs 3× in arena scoring · no product fully delivers this yet
- should-have
ai-native userChoose where my data is stored (region/residency)
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userControl data retention and deletion
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- should-have
ai-native userOpt out of telemetry and usage tracking
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
Rbac permissions — stories about rbac permissions in this arenaRbac permissions· 2 items
Stories about rbac permissions in this arena
- must-have
developerDefine roles and permissions and have them enforced and surfaced in session tokens for authorization checks
Core requirement — weighs 3× in arena scoring · 3 of 5 products fully deliver this today
- nice-to-have
security-engineerExpress fine-grained, resource-level authorization (relationship- or policy-based) beyond simple roles
Differentiator, not a dealbreaker — weighs 1× in arena scoring · 2 of 5 products fully deliver this today
Session management — stories about session management in this arenaSession management· 2 items
Stories about session management in this arena
- must-have
developerManage session lifecycle — expiry, refresh, and immediate server-side revocation of a compromised session
Core requirement — weighs 3× in arena scoring · 2 of 5 products fully deliver this today
- nice-to-have
security-engineerLet users and admins see active sessions and devices and revoke them individually or all at once
Differentiator, not a dealbreaker — weighs 1× in arena scoring · 1 of 5 products fully deliver this today
User migration — stories about user migration in this arenaUser migration· 2 items
Stories about user migration in this arena
- should-have
developerBulk-import existing users — including password hashes — and export them again, so I am never locked in
Important, not disqualifying — weighs 2× in arena scoring · no product fully delivers this yet
- nice-to-have
founderFollow vendor-maintained migration guides or tooling for moving off a competing auth provider without forcing password resets
Differentiator, not a dealbreaker — weighs 1× in arena scoring · 1 of 5 products fully deliver this today
Full evidence behind every verdict lives on the arena page and each product page — chips above deep-link straight to the judged story.