Auth & Identity — procurement report
ProductArena · rankings as of 2026-09-16 · evidence as of 2026-09-16 · 5 products · 56 judged requirements · 280 judged cells
Methodology: Every product is judged against a shared taxonomy of user stories using cited evidence — hands-on probes > repository code > independent community sources > vendor claims — never opinion. Full writeup: https://ultrametric.ai/productarena/methodology
Leaderboard
| # | Product | PA Score | Coverage score | Applicable cells | Confidence |
|---|---|---|---|---|---|
| 1 | Auth0 | 32.3 | 43.1 | 54/56 | C |
| 2 | Clerk | 32.3 | 36.9 | 53/56 | B |
| 3 | Better Auth | 31.1 | 39.5 | 50/56 | B |
| 4 | WorkOS | 23.1 | 36.0 | 51/56 | B |
| 5 | Keycloak | 22.2 | 38.1 | 49/56 | C |
PA Score = agent-readiness blend (see methodology). Coverage score = weighted share of judged requirements met. Confidence = how much of the score rests on tested vs claimed evidence (A–D).
Uncertainty note
This arena is currently a close race: Auth0 (32.3) vs Clerk (32.3), a gap of 0.0 PA Score. The ordering was re-checked with extra judge samples: 34 decisive cells were triple-judged and 8 came back unstable. Treat the #1/#2 ordering as contested — shortlist both.
Buyer checklist (RFP)
The arena's 56 judged user stories as requirements, grouped by theme. Priorities mirror the story weights our scoring uses (3 = must-have, 2 = should-have, 1 = nice-to-have). Interactive version with per-requirement verdicts for the top products: /arena/auth-platforms/checklist
Agent auth — stories about agent auth in this arenaAgent auth
Stories about agent auth in this arena
- ai-native userHave an agent obtain short-lived, user-consented tokens for third-party APIs (token vault/exchange) so tool calls run under the user's delegated authoritymust-have
- ai-native userIssue machine-to-machine credentials (client-credentials flow) so backend services and agents authenticate without a human in the loopmust-have
- ai-native userGive each agent its own least-privilege machine identity with narrowly scoped permissions and instant revocation, instead of sharing a human's credentialsmust-have
- ai-native userPut a spec-compliant OAuth authorization flow in front of my MCP server so remote agents connect with scoped, verifiable tokensmust-have
- ai-native userRequire asynchronous human approval (e.g. CIBA-style confirmation) before an autonomous agent completes a sensitive transactionshould-have
- ai-native userAuthenticate CLIs and headless agents via the OAuth device authorization flow instead of pasting long-lived secretsshould-have
Agenticness — how well agents can access and operate the productAgenticness
How well agents can access and operate the product
- ai-native userPlug MCP servers into this product so it can use their toolsmust-have
- ai-native userConnect an agent via an official MCP servermust-have
- ai-native userDrive the product through a documented public APImust-have
- ai-native userDelegate tasks to a built-in AI assistant inside the productmust-have
- ai-native userPoint an agent at llms.txt or agent-oriented docsshould-have
- ai-native userRun the product headlessly / in CI for automationshould-have
- ai-native userUse an official CLIshould-have
- ai-native userIssue scoped/least-privilege API credentials for an agentshould-have
- ai-native userBuild against official SDKsshould-have
- ai-native userSubscribe to events via webhooksshould-have
- ai-native userGet AI-generated insights and suggestions from my data inside the productshould-have
- ai-native userSet up automations that run autonomously in the backgroundshould-have
- ai-native userOperate the product with natural-language commandsshould-have
- ai-native userExplore an interactive API reference with runnable examplesshould-have
- ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)should-have
- ai-native userRely on versioned APIs with a documented deprecation policyshould-have
- ai-native userTest against a sandbox environment without touching production datanice-to-have
Automation depth — how much of the product can run unattendedAutomation depth
How much of the product can run unattended
- ai-native userDefine rules that trigger actions automatically on eventsmust-have
- ai-native userPerform bulk operations across many items at onceshould-have
- ai-native userSchedule recurring jobs or workflowsshould-have
- ai-native userVersion, review, and roll back my automationsnice-to-have
Deployment control — stories about deployment control in this arenaDeployment control
Stories about deployment control in this arena
- security-engineerControl where the auth system and its user data run — self-managed deployment, private instance, or my own databaseshould-have
Enterprise sso — stories about enterprise sso in this arenaEnterprise sso
Stories about enterprise sso in this arena
- security-engineerConnect enterprise identity providers over SAML and OIDC (Okta, Entra, Google Workspace) for workforce sign-inmust-have
- security-engineerSync users and groups from customer directories via SCIM so deprovisioning in the IdP revokes app accessshould-have
Events webhooks — stories about events webhooks in this arenaEvents webhooks
Stories about events webhooks in this arena
- security-engineerCapture tamper-evident audit logs of authentication and admin activity and stream or export them to my SIEMshould-have
- developerSubscribe to webhooks or event streams for auth events (sign-ups, sign-ins, user changes) to keep my systems in syncshould-have
Framework integration — stories about framework integration in this arenaFramework integration
Stories about framework integration in this arena
- developerProtect routes with first-party framework SDKs and middleware (Next.js and peers) that verify sessions at the edgemust-have
- developerShip production sign-in, sign-up, and profile management with prebuilt, customizable UI components or hosted pagesshould-have
Mfa passwordless — stories about mfa passwordless in this arenaMfa passwordless
Stories about mfa passwordless in this arena
- security-engineerRequire multi-factor authentication with TOTP authenticator apps and backup codes, with step-up enforcement where neededmust-have
- developerOffer passkeys/WebAuthn and passwordless options like magic links or email OTP as first-class sign-in methodsshould-have
- security-engineerRely on built-in protection against bots, credential stuffing, and brute-force attacks on the auth flowsnice-to-have
Oauth oidc — stories about oauth oidc in this arenaOauth oidc
Stories about oauth oidc in this arena
- developerImplement standard OAuth 2.0 / OIDC flows (authorization code with PKCE, refresh tokens) without hand-rolling protocol detailsmust-have
- developerOffer sign-in with a broad set of social and OAuth identity providers through configuration, not custom codeshould-have
- developerTurn my own application into an OAuth provider that issues tokens to third-party clients ("Sign in with my app")should-have
Openness — open source, data portability, and self-hosting storiesOpenness
Open source, data portability, and self-hosting stories
- ai-native userExport all of my data in open formats and leavemust-have
- ai-native userSelf-host the core productmust-have
- ai-native userDo everything through the API that I can do in the UIshould-have
- ai-native userRead the product's source under an open licenseshould-have
Orgs multitenant — stories about orgs multitenant in this arenaOrgs multitenant
Stories about orgs multitenant in this arena
- developerModel multi-tenant B2B apps with organizations, memberships, and invitation flows out of the boxmust-have
- security-engineerGive each customer organization its own SSO connection with verified domains and just-in-time provisioningshould-have
Privacy posture — data-handling and privacy storiesPrivacy posture
Data-handling and privacy stories
- ai-native userPrevent my data from being used to train AI modelsmust-have
- ai-native userChoose where my data is stored (region/residency)should-have
- ai-native userControl data retention and deletionshould-have
- ai-native userOpt out of telemetry and usage trackingshould-have
Rbac permissions — stories about rbac permissions in this arenaRbac permissions
Stories about rbac permissions in this arena
- developerDefine roles and permissions and have them enforced and surfaced in session tokens for authorization checksmust-have
- security-engineerExpress fine-grained, resource-level authorization (relationship- or policy-based) beyond simple rolesnice-to-have
Session management — stories about session management in this arenaSession management
Stories about session management in this arena
- developerManage session lifecycle — expiry, refresh, and immediate server-side revocation of a compromised sessionmust-have
- security-engineerLet users and admins see active sessions and devices and revoke them individually or all at oncenice-to-have
User migration — stories about user migration in this arenaUser migration
Stories about user migration in this arena
- developerBulk-import existing users — including password hashes — and export them again, so I am never locked inshould-have
- founderFollow vendor-maintained migration guides or tooling for moving off a competing auth provider without forcing password resetsnice-to-have
Appendix: recorded probes
No replayable probe recordings exist for this arena yet. Probe-tier evidence (hands-on checks) still backs verdicts where cited — see each product page for the evidence trail.
Cite as: ProductArena by Ultrametric Inc, Auth & Identity arena, rankings as of 2026-09-16 — https://ultrametric.ai/productarena/arena/auth-platforms
License: © 2026 Ultrametric Inc. Brief quotation of individual verdicts, scores, or evidence excerpts is permitted with attribution to "ProductArena by Ultrametric Inc (ultrametric.ai/productarena)", as is use of the data to evaluate, contest, or contribute corrections. Bulk copying, redistribution, or use to build competing datasets requires prior written permission (see DATA-LICENSE in the repository).
No liability: rankings, verdicts, and scores are research outputs derived from the cited evidence at a point in time, provided "as is", without warranties. Ultrametric Inc accepts no responsibility for procurement, purchasing, or other decisions made in reliance on them — verify against the cited evidence before acting (https://ultrametric.ai/productarena/terms).