{
  "name": "Identity Developer Experience Benchmark",
  "publisher": "Start with Identity",
  "url": "https://startwithidentity.com/tools/developer-experience/",
  "license": "CC BY 4.0",
  "checked_on": "2026-11-05",
  "rubric": {
    "dimensions": [
      {
        "id": "sdks",
        "label": "SDKs",
        "max": 15
      },
      {
        "id": "ui",
        "label": "Prebuilt UI",
        "max": 10
      },
      {
        "id": "methods",
        "label": "Auth methods",
        "max": 20
      },
      {
        "id": "quickstart",
        "label": "Quickstart",
        "max": 5
      },
      {
        "id": "local_dev",
        "label": "Local development",
        "max": 10
      },
      {
        "id": "api",
        "label": "APIs",
        "max": 20
      },
      {
        "id": "ai",
        "label": "AI era",
        "max": 15
      },
      {
        "id": "open_source",
        "label": "Open source",
        "max": 5
      }
    ],
    "methodology": "https://startwithidentity.com/tools/developer-experience/#how-the-score-works"
  },
  "count": 28,
  "vendors": [
    {
      "key": "ciam/auth0",
      "name": "Auth0",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "python",
          "go",
          "java",
          "dotnet",
          "ruby",
          "php"
        ],
        "frontend": [
          "react",
          "nextjs",
          "vue",
          "angular",
          "ios",
          "android",
          "flutter",
          "react-native"
        ],
        "sources": [
          {
            "title": "Auth0 libraries",
            "url": "https://auth0.com/docs/libraries"
          },
          {
            "title": "Auth0 GitHub organization",
            "url": "https://github.com/auth0"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Lock (embedded login widget)",
            "url": "https://auth0.com/docs/libraries/lock"
          },
          {
            "title": "Passkeys (Universal Login sign-up prompts)",
            "url": "https://auth0.com/docs/authenticate/database-connections/passkeys"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "yes",
        "scim": "yes",
        "sources": [
          {
            "title": "Passkeys",
            "url": "https://auth0.com/docs/authenticate/database-connections/passkeys"
          },
          {
            "title": "Passwordless",
            "url": "https://auth0.com/docs/authenticate/passwordless"
          },
          {
            "title": "Self-Service Enterprise Configuration",
            "url": "https://auth0.com/docs/authenticate/enterprise-connections/self-service-SSO"
          },
          {
            "title": "Configure Inbound SCIM",
            "url": "https://auth0.com/docs/authenticate/protocols/scim/configure-inbound-scim"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://auth0.com/docs/quickstart/webapp/nextjs",
        "steps": 11,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "partial",
        "free_tier": "yes",
        "note": "Auth0 recommends a separate tenant per environment (development, staging, production); there is no local emulator.",
        "sources": [
          {
            "title": "Set up multiple environments",
            "url": "https://auth0.com/docs/get-started/auth0-overview/create-tenants/set-up-multiple-environments"
          },
          {
            "title": "Auth0 pricing",
            "url": "https://auth0.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://auth0.com/docs/oas/management/v2/management-api-oas.json",
        "webhooks": "yes",
        "rate_limits_url": "https://auth0.com/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy",
        "status_page_url": "https://status.auth0.com",
        "changelog_url": "https://auth0.com/changelog",
        "changelog_last_entry": "2026-10-30",
        "sources": [
          {
            "title": "Management API v2",
            "url": "https://auth0.com/docs/api/management/v2"
          },
          {
            "title": "Events (event streams)",
            "url": "https://auth0.com/docs/customize/events"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://github.com/auth0/auth0-mcp-server",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "yes",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://auth0.com/docs/llms.txt",
        "sources": [
          {
            "title": "Secure AI agents and MCP servers",
            "url": "https://auth0.com/docs/ai-agents-mcp"
          },
          {
            "title": "Auth for MCP",
            "url": "https://auth0.com/ai/docs/mcp/intro/overview"
          },
          {
            "title": "Custom Token Exchange (RFC 8693)",
            "url": "https://auth0.com/docs/authenticate/custom-token-exchange"
          }
        ]
      },
      "open_source": {
        "self_host": "no",
        "license": null,
        "repo_url": "https://github.com/auth0/nextjs-auth0"
      },
      "ecosystem": {
        "github_repo": "auth0/nextjs-auth0",
        "github_stars": 2313,
        "npm_package": "@auth0/nextjs-auth0",
        "npm_weekly_downloads": 1263928,
        "measured_on": "2026-11-05"
      },
      "notes": "The Free plan covers up to 25,000 monthly active users and includes 1 enterprise connection, Self-Service SSO and SCIM; on the paid B2C plans enterprise connections and SCIM need an upgrade to a B2B plan. Custom Token Exchange is on B2C Professional, B2B Professional and Enterprise plans. The Management API OpenAPI 3.1 schema is labelled beta.",
      "score": 89.5,
      "score_breakdown": {
        "sdks": 14,
        "ui": 10,
        "methods": 20,
        "quickstart": 3,
        "local_dev": 7.5,
        "api": 20,
        "ai": 15,
        "open_source": 0
      },
      "changelog_fresh": true
    },
    {
      "key": "ciam/clerk",
      "name": "Clerk",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "dotnet",
          "go",
          "java",
          "php",
          "python",
          "ruby"
        ],
        "frontend": [
          "nextjs",
          "react",
          "react-native",
          "android",
          "ios",
          "vue"
        ],
        "sources": [
          {
            "title": "Clerk SDK references",
            "url": "https://clerk.com/docs/reference/overview"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Account Portal overview",
            "url": "https://clerk.com/docs/guides/account-portal/overview"
          },
          {
            "title": "Sign-up and sign-in options (passkeys)",
            "url": "https://clerk.com/docs/guides/configure/auth-strategies/sign-up-sign-in-options"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "yes",
        "scim": "yes",
        "sources": [
          {
            "title": "Sign-up and sign-in options",
            "url": "https://clerk.com/docs/guides/configure/auth-strategies/sign-up-sign-in-options"
          },
          {
            "title": "Self-serve SSO",
            "url": "https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/self-serve-sso"
          },
          {
            "title": "Self-serve Directory Sync",
            "url": "https://clerk.com/docs/guides/configure/auth-strategies/enterprise-connections/self-serve-directory-sync"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://clerk.com/docs/nextjs/getting-started/quickstart",
        "steps": 7,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Every Clerk application has a development instance, and the Clerk CLI can provision a claimable app with development keys written to .env.local; all features are free in development mode.",
        "sources": [
          {
            "title": "Deploy to production (development vs production instances)",
            "url": "https://clerk.com/docs/guides/development/deployment/production"
          },
          {
            "title": "Clerk pricing",
            "url": "https://clerk.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://github.com/clerk/openapi-specs",
        "webhooks": "yes",
        "rate_limits_url": "https://clerk.com/docs/guides/how-clerk-works/system-limits",
        "status_page_url": "https://status.clerk.com",
        "changelog_url": "https://clerk.com/changelog",
        "changelog_last_entry": "2026-11-04",
        "sources": [
          {
            "title": "Clerk OpenAPI specs (Backend and Frontend API)",
            "url": "https://github.com/clerk/openapi-specs"
          },
          {
            "title": "Rate limits",
            "url": "https://clerk.com/docs/guides/how-clerk-works/system-limits"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://clerk.com/docs/guides/ai/mcp/clerk-mcp-server",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "unknown",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://clerk.com/docs/llms.txt",
        "sources": [
          {
            "title": "Use Clerk's MCP server",
            "url": "https://clerk.com/docs/guides/ai/mcp/clerk-mcp-server"
          },
          {
            "title": "Build an MCP server in your application with Clerk",
            "url": "https://clerk.com/docs/nextjs/guides/ai/mcp/build-mcp-server"
          },
          {
            "title": "M2M tokens: createToken()",
            "url": "https://clerk.com/docs/reference/backend/m2m-tokens/create-token"
          }
        ]
      },
      "open_source": {
        "self_host": "no",
        "license": null,
        "repo_url": "https://github.com/clerk/javascript"
      },
      "ecosystem": {
        "github_repo": "clerk/javascript",
        "github_stars": 1777,
        "npm_package": "@clerk/nextjs",
        "npm_weekly_downloads": 3703143,
        "measured_on": "2026-11-05"
      },
      "notes": "The free Hobby plan covers 50,000 monthly retained users per app; passkeys need a paid plan in production, though every feature is free in development mode. Pro includes 1 enterprise SSO connection and 1 Directory Sync connection, with more at $75 a month each. Angular, Svelte and Flutter SDKs exist only as community projects, and the server-side JS SDKs are open source while the service itself is not self-hostable.",
      "score": 89,
      "score_breakdown": {
        "sdks": 12,
        "ui": 10,
        "methods": 20,
        "quickstart": 4,
        "local_dev": 10,
        "api": 20,
        "ai": 13,
        "open_source": 0
      },
      "changelog_fresh": true
    },
    {
      "key": "open-source/logto",
      "name": "Logto",
      "kind": "open-source",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "dotnet",
          "go",
          "php",
          "python",
          "ruby"
        ],
        "frontend": [
          "react",
          "nextjs",
          "vue",
          "angular",
          "svelte",
          "ios",
          "android",
          "flutter",
          "react-native"
        ],
        "sources": [
          {
            "title": "Logto quick starts",
            "url": "https://docs.logto.io/quick-starts"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "no",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Bring your UI (hosted sign-in experience)",
            "url": "https://docs.logto.io/customization/bring-your-ui"
          },
          {
            "title": "Account Center UI (add and manage passkeys)",
            "url": "https://docs.logto.io/end-user-flows/account-settings/by-account-center-ui"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "unknown",
        "sources": [
          {
            "title": "Passkey sign-in",
            "url": "https://docs.logto.io/end-user-flows/sign-up-and-sign-in/passkey-sign-in"
          },
          {
            "title": "Magic link (one-time token)",
            "url": "https://docs.logto.io/end-user-flows/one-time-token"
          },
          {
            "title": "Enterprise SSO",
            "url": "https://docs.logto.io/end-user-flows/enterprise-sso"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js (App Router)",
        "url": "https://docs.logto.io/quick-starts/next-app-router",
        "steps": 6,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Logto OSS runs locally (Docker or npm), and Logto Cloud has a free plan for up to 50,000 MAU.",
        "sources": [
          {
            "title": "Get started with Logto OSS",
            "url": "https://docs.logto.io/logto-oss/get-started-with-oss"
          },
          {
            "title": "Logto pricing",
            "url": "https://logto.io/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://openapi.logto.io",
        "webhooks": "yes",
        "rate_limits_url": null,
        "status_page_url": "https://status.logto.io",
        "changelog_url": "https://github.com/logto-io/logto/releases",
        "changelog_last_entry": "2026-11-05",
        "sources": [
          {
            "title": "Logto API reference (OpenAPI)",
            "url": "https://openapi.logto.io"
          },
          {
            "title": "Webhooks",
            "url": "https://docs.logto.io/developers/webhooks"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://docs.logto.io/logto-cloud/logto-mcp-server",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "yes",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://docs.logto.io/llms.txt",
        "sources": [
          {
            "title": "Logto MCP server",
            "url": "https://docs.logto.io/logto-cloud/logto-mcp-server"
          },
          {
            "title": "Add auth to an MCP server",
            "url": "https://docs.logto.io/use-cases/ai/mcp-server-add-auth"
          },
          {
            "title": "Enable third-party AI agent access",
            "url": "https://docs.logto.io/use-cases/ai/enable-third-party-ai-agent-access"
          },
          {
            "title": "Machine-to-machine quick start",
            "url": "https://docs.logto.io/quick-starts/m2m"
          },
          {
            "title": "User impersonation (token exchange grant)",
            "url": "https://docs.logto.io/developers/user-impersonation"
          }
        ]
      },
      "open_source": {
        "self_host": "yes",
        "license": "MPL-2.0",
        "repo_url": "https://github.com/logto-io/logto"
      },
      "ecosystem": {
        "github_repo": "logto-io/logto",
        "github_stars": 14849,
        "npm_package": "@logto/next",
        "npm_weekly_downloads": 31007,
        "measured_on": "2026-11-05"
      },
      "notes": "Sign-in is a Logto-hosted (or self-hosted) sign-in experience that can be replaced with your own uploaded UI, not embeddable components; the Account Center UI lets users add and manage passkeys. Enterprise SSO covers SAML and OIDC connectors configured in the Console, and the docs say enterprise SSO users cannot use passkey sign-in. No SCIM documentation or API rate-limit page was found in the English docs.",
      "score": 86,
      "score_breakdown": {
        "sdks": 15,
        "ui": 6,
        "methods": 14,
        "quickstart": 4,
        "local_dev": 10,
        "api": 17,
        "ai": 15,
        "open_source": 5
      },
      "changelog_fresh": true
    },
    {
      "key": "ciam/workos",
      "name": "WorkOS (AuthKit)",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "python",
          "go",
          "java",
          "dotnet",
          "ruby",
          "php",
          "rust",
          "elixir"
        ],
        "frontend": [
          "nextjs",
          "react",
          "ios",
          "android"
        ],
        "sources": [
          {
            "title": "WorkOS SDKs: Node",
            "url": "https://workos.com/docs/sdks/node"
          },
          {
            "title": "WorkOS SDKs: AuthKit Next.js",
            "url": "https://workos.com/docs/sdks/authkit-nextjs"
          },
          {
            "title": "WorkOS docs index (llms.txt)",
            "url": "https://workos.com/docs/llms.txt"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "partial",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "AuthKit with Next.js (hosted authentication flow)",
            "url": "https://workos.com/docs/authkit/nextjs"
          },
          {
            "title": "User Security widget",
            "url": "https://workos.com/docs/widgets/user-security"
          },
          {
            "title": "Widgets API: register passkey",
            "url": "https://workos.com/docs/widgets-api/authentication/register-passkey"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "partial",
        "social_login": "yes",
        "enterprise_sso": "yes",
        "scim": "yes",
        "sources": [
          {
            "title": "Passkeys",
            "url": "https://workos.com/docs/authkit/passkeys"
          },
          {
            "title": "Magic Auth",
            "url": "https://workos.com/docs/reference/authkit/magic-auth"
          },
          {
            "title": "Admin Portal",
            "url": "https://workos.com/docs/admin-portal"
          },
          {
            "title": "Directory Sync",
            "url": "https://workos.com/docs/directory-sync"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://workos.com/docs/authkit/nextjs",
        "steps": 2,
        "time_claim": "Integrating AuthKit into your app can be done in less than ten minutes."
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Every WorkOS account has a staging environment with a Test Organization and a mock identity provider for testing SSO end to end.",
        "sources": [
          {
            "title": "Directory Sync and SSO guides (staging environment)",
            "url": "https://workos.com/docs/directory-sync"
          },
          {
            "title": "WorkOS pricing",
            "url": "https://workos.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://github.com/workos/openapi-spec",
        "webhooks": "yes",
        "rate_limits_url": "https://workos.com/docs/reference/rate-limits",
        "status_page_url": "https://status.workos.com",
        "changelog_url": "https://workos.com/changelog",
        "changelog_last_entry": "2026-11-04",
        "sources": [
          {
            "title": "Events",
            "url": "https://workos.com/docs/events"
          },
          {
            "title": "Rate limits",
            "url": "https://workos.com/docs/reference/rate-limits"
          },
          {
            "title": "WorkOS OpenAPI spec",
            "url": "https://github.com/workos/openapi-spec"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://workos.com/docs/mcp",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "yes",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://workos.com/docs/llms.txt",
        "sources": [
          {
            "title": "WorkOS MCP Server",
            "url": "https://workos.com/docs/mcp"
          },
          {
            "title": "AuthKit: Model Context Protocol",
            "url": "https://workos.com/docs/authkit/mcp"
          },
          {
            "title": "M2M applications",
            "url": "https://workos.com/docs/authkit/connect/m2m"
          },
          {
            "title": "Token exchange grant (RFC 8693)",
            "url": "https://workos.com/docs/reference/workos-connect/token/token-exchange-grant"
          }
        ]
      },
      "open_source": {
        "self_host": "no",
        "license": null,
        "repo_url": "https://github.com/workos/authkit-nextjs"
      },
      "ecosystem": {
        "github_repo": "workos/authkit-nextjs",
        "github_stars": 156,
        "npm_package": "@workos-inc/authkit-nextjs",
        "npm_weekly_downloads": 1429733,
        "measured_on": "2026-11-05"
      },
      "notes": "AuthKit user management is free up to 1 million monthly active users; enterprise SSO and Directory Sync are billed per connection. Sign-in is a hosted AuthKit page; the embeddable Widgets cover profile, security (including passkey registration) and admin screens rather than the sign-in form, so embeddable components are partial. Magic Auth sends a one-time email code rather than a link, which the rubric scores as partial.",
      "score": 86,
      "score_breakdown": {
        "sdks": 10,
        "ui": 8,
        "methods": 18,
        "quickstart": 5,
        "local_dev": 10,
        "api": 20,
        "ai": 15,
        "open_source": 0
      },
      "changelog_fresh": true
    },
    {
      "key": "ciam/descope",
      "name": "Descope",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "python",
          "go",
          "java",
          "ruby",
          "php",
          "dotnet"
        ],
        "frontend": [
          "react",
          "nextjs",
          "vue",
          "angular",
          "ios",
          "android",
          "flutter",
          "react-native"
        ],
        "sources": [
          {
            "title": "Getting started (framework and backend quickstarts)",
            "url": "https://docs.descope.com/getting-started"
          },
          {
            "title": "Descope JS SDKs monorepo",
            "url": "https://github.com/descope/descope-js"
          },
          {
            "title": "Descope GitHub organization",
            "url": "https://github.com/descope"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Auth Hosting",
            "url": "https://docs.descope.com/identity-federation/auth-hosting"
          },
          {
            "title": "Passkeys (WebAuthn) in flows",
            "url": "https://docs.descope.com/auth-methods/passkeys"
          },
          {
            "title": "Next.js quickstart (Descope Flows component)",
            "url": "https://docs.descope.com/getting-started/nextjs"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "yes",
        "scim": "yes",
        "sources": [
          {
            "title": "Magic Link",
            "url": "https://docs.descope.com/auth-methods/magic-link"
          },
          {
            "title": "SSO Setup Suite",
            "url": "https://docs.descope.com/auth-methods/sso/sso-setup-suite"
          },
          {
            "title": "SCIM",
            "url": "https://docs.descope.com/management/tenant-management/scim"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://docs.descope.com/getting-started/nextjs",
        "steps": 6,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "partial",
        "free_tier": "yes",
        "note": "Descope recommends separate development, staging and production projects and documents migrating configuration between them; there is no local emulator.",
        "sources": [
          {
            "title": "Managing environments",
            "url": "https://docs.descope.com/how-to-deploy-to-production/managing-environments"
          },
          {
            "title": "Descope pricing",
            "url": "https://www.descope.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://docs.descope.com/examples/Descope_API.yaml",
        "webhooks": "partial",
        "rate_limits_url": "https://docs.descope.com/rate-limiting",
        "status_page_url": "https://status.descope.com",
        "changelog_url": "https://ideas.descope.works/changelog",
        "changelog_last_entry": null,
        "sources": [
          {
            "title": "OpenAPI specification",
            "url": "https://docs.descope.com/api/openapi-spec"
          },
          {
            "title": "Audit Webhook connector",
            "url": "https://docs.descope.com/connectors/connector-configuration-guides/network/audit-webhook"
          },
          {
            "title": "Rate limits",
            "url": "https://docs.descope.com/rate-limiting"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://docs.descope.com/mcp/mcp-server",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "yes",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://docs.descope.com/llms.txt",
        "sources": [
          {
            "title": "Descope MCP Server",
            "url": "https://docs.descope.com/mcp/mcp-server"
          },
          {
            "title": "Model Context Protocol (MCP)",
            "url": "https://docs.descope.com/mcp"
          },
          {
            "title": "Agent Auth SDK (RFC 8693 token exchange)",
            "url": "https://docs.descope.com/agentic-identity-hub/agent-auth-sdk"
          },
          {
            "title": "Client credentials grant",
            "url": "https://docs.descope.com/identity-federation/inbound-apps/grant-types/client-credentials"
          }
        ]
      },
      "open_source": {
        "self_host": "no",
        "license": null,
        "repo_url": "https://github.com/descope/descope-js"
      },
      "ecosystem": {
        "github_repo": "descope/descope-js",
        "github_stars": 72,
        "npm_package": "@descope/nextjs-sdk",
        "npm_weekly_downloads": 87015,
        "measured_on": "2026-11-05"
      },
      "notes": "The Free Forever tier allows up to 7,500 monthly active users, 10 tenants and 3 SSO connections. Webhooks are delivered through the Audit Webhook connector and HTTP connectors in flows rather than a dedicated webhooks product. The changelog is hosted on Descope's ideas portal and its entries did not render for reading, so its last entry date is not recorded.",
      "score": 85.5,
      "score_breakdown": {
        "sdks": 14,
        "ui": 10,
        "methods": 20,
        "quickstart": 4,
        "local_dev": 7.5,
        "api": 15,
        "ai": 15,
        "open_source": 0
      },
      "changelog_fresh": false
    },
    {
      "key": "ciam/frontegg",
      "name": "Frontegg",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "python",
          "go",
          "java"
        ],
        "frontend": [
          "react",
          "nextjs",
          "vue",
          "angular",
          "ios",
          "android",
          "flutter",
          "react-native"
        ],
        "sources": [
          {
            "title": "Frontegg docs index (SDK pages)",
            "url": "https://developers.frontegg.com/llms.txt"
          },
          {
            "title": "Mobile SDKs overview",
            "url": "https://developers.frontegg.com/ciam/sdks/mobile/overview"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Hosted vs embedded implementation",
            "url": "https://developers.frontegg.com/ciam/guides/env-settings/hosted-embedded"
          },
          {
            "title": "Passkeys authentication",
            "url": "https://developers.frontegg.com/ciam/guides/authentication/credentials/passkeys"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "yes",
        "scim": "yes",
        "sources": [
          {
            "title": "Passwordless authentication",
            "url": "https://developers.frontegg.com/ciam/guides/authentication/credentials/passwordless"
          },
          {
            "title": "Social provider authentication",
            "url": "https://developers.frontegg.com/ciam/guides/authentication/social/overview"
          },
          {
            "title": "Self-service (admin) portal",
            "url": "https://developers.frontegg.com/ciam/guides/admin-portal/intro"
          },
          {
            "title": "SCIM provisioning",
            "url": "https://developers.frontegg.com/ciam/guides/management/manage-users/scim/overview"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js (App Router, hosted login)",
        "url": "https://developers.frontegg.com/ciam/sdks/frontend/next/app-router/hosted-login",
        "steps": 5,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Frontegg supports up to four environments (Development, Staging, QA, Production), each with its own client ID, API key and domain.",
        "sources": [
          {
            "title": "Working with environments",
            "url": "https://developers.frontegg.com/ciam/guides/env-settings/overview"
          },
          {
            "title": "Frontegg pricing",
            "url": "https://frontegg.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": null,
        "webhooks": "yes",
        "rate_limits_url": "https://developers.frontegg.com/ciam/guides/env-settings/rate-limits",
        "status_page_url": "https://status.frontegg.com",
        "changelog_url": "https://developers.frontegg.com/ciam/guides/troubleshoot/changelog",
        "changelog_last_entry": "2024-12",
        "sources": [
          {
            "title": "Webhooks",
            "url": "https://developers.frontegg.com/ciam/guides/integrations/webhooks"
          },
          {
            "title": "Rate limits",
            "url": "https://developers.frontegg.com/ciam/guides/env-settings/rate-limits"
          },
          {
            "title": "Changelog",
            "url": "https://developers.frontegg.com/ciam/guides/troubleshoot/changelog"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://github.com/frontegg/frontegg-mcp-server",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "yes",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://developers.frontegg.com/llms.txt",
        "sources": [
          {
            "title": "Frontegg MCP Server (Management API tools)",
            "url": "https://github.com/frontegg/frontegg-mcp-server"
          },
          {
            "title": "Host the MCP Gateway",
            "url": "https://developers.frontegg.com/agen-for-saas/configuration/hosting-mcp-gateway"
          },
          {
            "title": "Token exchange (on-behalf-of, RFC 8693)",
            "url": "https://developers.frontegg.com/ciam/guides/authentication/m2m/token-exchange"
          },
          {
            "title": "AI agents with Frontegg Entitlements",
            "url": "https://developers.frontegg.com/ciam/guides/frontegg-ai/agent-authorization"
          }
        ]
      },
      "open_source": {
        "self_host": "no",
        "license": null,
        "repo_url": "https://github.com/frontegg/frontegg-nextjs"
      },
      "ecosystem": {
        "github_repo": "frontegg/frontegg-nextjs",
        "github_stars": 7,
        "npm_package": "@frontegg/nextjs",
        "npm_weekly_downloads": 10814,
        "measured_on": "2026-11-05"
      },
      "notes": "Pay as you go starts free with up to 7,500 monthly active users and 5 enterprise SSO or SCIM connections; Enterprise plans are custom. Once passkeys are enabled, the login box prompts users to set one up at their next login. The changelog page in the docs lists monthly entries ending December 2024, and no downloadable OpenAPI file is linked.",
      "score": 85,
      "score_breakdown": {
        "sdks": 12,
        "ui": 10,
        "methods": 20,
        "quickstart": 5,
        "local_dev": 10,
        "api": 13,
        "ai": 15,
        "open_source": 0
      },
      "changelog_fresh": false
    },
    {
      "key": "ciam/fusionauth",
      "name": "FusionAuth",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "java",
          "dotnet",
          "go",
          "php",
          "python",
          "ruby",
          "node"
        ],
        "frontend": [
          "react",
          "vue",
          "angular",
          "ios",
          "android"
        ],
        "sources": [
          {
            "title": "Client libraries and SDKs",
            "url": "https://fusionauth.io/docs/sdks"
          },
          {
            "title": "SDKs index",
            "url": "https://fusionauth.io/docs/llms-sdks.txt"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "partial",
        "passkey_enrollment_ui": "unknown",
        "sources": [
          {
            "title": "Cloud-hosted vs self-hosted FusionAuth (hosted login pages)",
            "url": "https://fusionauth.io/docs/cloud/cloud-vs-self-hosted"
          },
          {
            "title": "React SDK",
            "url": "https://fusionauth.io/docs/sdks/react-sdk"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "yes",
        "sources": [
          {
            "title": "Passkeys",
            "url": "https://fusionauth.io/docs/authentication/passkeys"
          },
          {
            "title": "One-time passwords and magic links",
            "url": "https://fusionauth.io/docs/authentication/one-time-passwords"
          },
          {
            "title": "Identity Provider API",
            "url": "https://fusionauth.io/docs/apis/identity-providers"
          },
          {
            "title": "SCIM API",
            "url": "https://fusionauth.io/docs/apis/scim"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://fusionauth.io/docs/quickstarts/web/quickstart-javascript-nextjs-web",
        "steps": 11,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "FusionAuth documents running the full server locally with Docker, and the Community plan is free to self-host.",
        "sources": [
          {
            "title": "Install FusionAuth locally with Docker",
            "url": "https://fusionauth.io/docs/get-started/install"
          },
          {
            "title": "FusionAuth pricing",
            "url": "https://fusionauth.io/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://fusionauth.io/docs/openapi.yaml",
        "webhooks": "yes",
        "rate_limits_url": null,
        "status_page_url": "https://status.fusionauth.io",
        "changelog_url": "https://fusionauth.io/docs/release-notes",
        "changelog_last_entry": "2026-11-04",
        "sources": [
          {
            "title": "OpenAPI specification",
            "url": "https://fusionauth.io/docs/apis/openapi"
          },
          {
            "title": "Webhook API",
            "url": "https://fusionauth.io/docs/apis/webhooks"
          },
          {
            "title": "Release notes",
            "url": "https://fusionauth.io/docs/release-notes"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://github.com/FusionAuth/fusionauth-mcp-api",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "yes",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://fusionauth.io/docs/llms.txt",
        "sources": [
          {
            "title": "MCP server for the FusionAuth API",
            "url": "https://github.com/FusionAuth/fusionauth-mcp-api"
          },
          {
            "title": "Control MCP server access",
            "url": "https://fusionauth.io/docs/authorization/mcp-server-access"
          },
          {
            "title": "OAuth token exchange",
            "url": "https://fusionauth.io/docs/authorization/token-exchange"
          },
          {
            "title": "Entity API (client credentials)",
            "url": "https://fusionauth.io/docs/apis/entities"
          }
        ]
      },
      "open_source": {
        "self_host": "yes",
        "license": null,
        "repo_url": "https://github.com/FusionAuth/fusionauth-javascript-sdk"
      },
      "ecosystem": {
        "github_repo": "FusionAuth/fusionauth-javascript-sdk",
        "github_stars": 8,
        "npm_package": "@fusionauth/react-sdk",
        "npm_weekly_downloads": 18584,
        "measured_on": "2026-11-05"
      },
      "notes": "FusionAuth is downloadable and self-hostable but not open source. Passkeys need at least a Licensed Community plan and SCIM needs an Enterprise plan. SAML and OIDC identity providers are configured by the developer or through the API, with no customer-facing SSO setup portal, so enterprise SSO is partial; the React SDK ships login and account buttons rather than a full sign-in form, and the Next.js quickstart uses headed steps without numbers.",
      "score": 82,
      "score_breakdown": {
        "sdks": 11,
        "ui": 5,
        "methods": 18,
        "quickstart": 3,
        "local_dev": 10,
        "api": 17,
        "ai": 15,
        "open_source": 3
      },
      "changelog_fresh": true
    },
    {
      "key": "ciam/scalekit",
      "name": "Scalekit",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "python",
          "go",
          "java",
          "dotnet"
        ],
        "frontend": [
          "react",
          "vue",
          "ios",
          "react-native"
        ],
        "sources": [
          {
            "title": "Scalekit Node SDK",
            "url": "https://docs.scalekit.com/saaskit/sdks/node/"
          },
          {
            "title": "Scalekit GitHub organization",
            "url": "https://github.com/scalekit-inc"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "partial",
        "passkey_enrollment_ui": "unknown",
        "sources": [
          {
            "title": "Full Stack Auth quickstart (hosted auth page)",
            "url": "https://docs.scalekit.com/authenticate/fsa/quickstart"
          },
          {
            "title": "Admin portal (embeddable)",
            "url": "https://docs.scalekit.com/authenticate/sso/admin-portal"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "yes",
        "scim": "yes",
        "sources": [
          {
            "title": "Add passkeys login method",
            "url": "https://docs.scalekit.com/authenticate/auth-methods/passkeys"
          },
          {
            "title": "Sign in with magic link or email OTP",
            "url": "https://docs.scalekit.com/authenticate/auth-methods/passwordless"
          },
          {
            "title": "Admin portal",
            "url": "https://docs.scalekit.com/authenticate/sso/admin-portal"
          },
          {
            "title": "Modular SCIM quickstart",
            "url": "https://docs.scalekit.com/directory/scim/quickstart"
          }
        ]
      },
      "quickstart": {
        "framework": "Full Stack Auth (Node.js)",
        "url": "https://docs.scalekit.com/authenticate/fsa/quickstart",
        "steps": 5,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Signing up creates a Development environment, and Scalekit states that development environments are always on the Free plan and never billed.",
        "sources": [
          {
            "title": "Environments and regions",
            "url": "https://docs.scalekit.com/agentkit/environments"
          },
          {
            "title": "Scalekit pricing",
            "url": "https://www.scalekit.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://docs.scalekit.com/api/scalekit.scalar.json",
        "webhooks": "yes",
        "rate_limits_url": "https://docs.scalekit.com/reference/rate-limits",
        "status_page_url": "https://status.scalekit.com",
        "changelog_url": "https://github.com/scalekit-inc/scalekit-sdk-node/releases",
        "changelog_last_entry": "2026-10-28",
        "sources": [
          {
            "title": "OpenAPI specification",
            "url": "https://docs.scalekit.com/api/scalekit.scalar.json"
          },
          {
            "title": "API rate limits",
            "url": "https://docs.scalekit.com/reference/rate-limits"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://github.com/scalekit-inc/mcp",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "unknown",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://docs.scalekit.com/llms.txt",
        "sources": [
          {
            "title": "Scalekit MCP server",
            "url": "https://github.com/scalekit-inc/mcp"
          },
          {
            "title": "MCP Auth quickstart",
            "url": "https://docs.scalekit.com/authenticate/mcp/quickstart"
          },
          {
            "title": "AgentKit quickstart",
            "url": "https://docs.scalekit.com/agentkit/quickstart"
          },
          {
            "title": "Agent or machine calling an MCP server",
            "url": "https://docs.scalekit.com/authenticate/mcp/topologies/agent-mcp"
          }
        ]
      },
      "open_source": {
        "self_host": "no",
        "license": null,
        "repo_url": "https://github.com/scalekit-inc/scalekit-sdk-node"
      },
      "ecosystem": {
        "github_repo": "scalekit-inc/scalekit-sdk-node",
        "github_stars": 8,
        "npm_package": "@scalekit-sdk/node",
        "npm_weekly_downloads": 12732,
        "measured_on": "2026-11-05"
      },
      "notes": "Scalekit sells Full Stack Auth, modular SSO and SCIM for existing auth stacks, and AgentKit for agent connections. Sign-in runs on a Scalekit-hosted page; the embeddable piece is the admin portal customers use to configure SSO and SCIM, so embeddable components score partial. No product changelog page was found in the docs, so the Node SDK release history is used.",
      "score": 82,
      "score_breakdown": {
        "sdks": 9,
        "ui": 5,
        "methods": 20,
        "quickstart": 5,
        "local_dev": 10,
        "api": 20,
        "ai": 13,
        "open_source": 0
      },
      "changelog_fresh": true
    },
    {
      "key": "open-source/ory",
      "name": "Ory (Kratos, Hydra, Polis; Ory Network)",
      "kind": "open-source",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "python",
          "go",
          "java",
          "dotnet",
          "ruby",
          "php",
          "rust",
          "elixir"
        ],
        "frontend": [
          "react",
          "nextjs"
        ],
        "sources": [
          {
            "title": "Ory SDK clients (GitHub)",
            "url": "https://github.com/ory/sdk"
          },
          {
            "title": "Ory Elements",
            "url": "https://www.ory.com/docs/elements"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Account Experience (hosted self-service screens)",
            "url": "https://www.ory.com/docs/account-experience"
          },
          {
            "title": "Ory Elements",
            "url": "https://www.ory.com/docs/elements"
          },
          {
            "title": "Passkeys",
            "url": "https://www.ory.com/docs/network/kratos/passwordless/passkeys"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "partial",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "yes",
        "sources": [
          {
            "title": "Passwordless sign-in with passkeys",
            "url": "https://www.ory.com/docs/network/kratos/passwordless/passkeys"
          },
          {
            "title": "Email and SMS one-time code",
            "url": "https://www.ory.com/docs/network/kratos/passwordless/one-time-code"
          },
          {
            "title": "SAML sign-in",
            "url": "https://www.ory.com/docs/identities/sign-in/saml"
          },
          {
            "title": "SCIM",
            "url": "https://www.ory.com/docs/kratos/manage-identities/scim"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js (App Router)",
        "url": "https://www.ory.com/docs/getting-started/integrate-auth/nextjs-app-router-quickstart",
        "steps": 7,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Ory documents local development against an Ory Network project through the Ory CLI tunnel, and the open-source servers run on your own machine.",
        "sources": [
          {
            "title": "Develop applications on your local machine",
            "url": "https://www.ory.com/docs/getting-started/local-development"
          },
          {
            "title": "Ory pricing",
            "url": "https://www.ory.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://github.com/ory/sdk/tree/master/spec/client",
        "webhooks": "yes",
        "rate_limits_url": "https://www.ory.com/docs/guides/rate-limits",
        "status_page_url": "https://status.ory.sh",
        "changelog_url": "https://github.com/ory/kratos/releases",
        "changelog_last_entry": "2026-03-20",
        "sources": [
          {
            "title": "REST API reference",
            "url": "https://www.ory.com/docs/reference/api"
          },
          {
            "title": "Webhooks",
            "url": "https://www.ory.com/docs/guides/integrate-with-ory-cloud-through-webhooks"
          },
          {
            "title": "Ory Network rate limits",
            "url": "https://www.ory.com/docs/guides/rate-limits"
          }
        ]
      },
      "ai": {
        "mcp_server": "partial",
        "mcp_server_url": "https://www.ory.com/docs/ecosystem/mcp",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "unknown",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://www.ory.com/docs/llms.txt",
        "sources": [
          {
            "title": "Ory Docs MCP Server",
            "url": "https://www.ory.com/docs/ecosystem/mcp"
          },
          {
            "title": "Add browser login to your MCP server",
            "url": "https://www.ory.com/docs/guides/mcp/hydra-oauth"
          },
          {
            "title": "Agentic IAM solution",
            "url": "https://www.ory.com/docs/solutions/solution-agentic"
          },
          {
            "title": "OAuth2 client credentials flow",
            "url": "https://www.ory.com/docs/oauth2-oidc/client-credentials"
          }
        ]
      },
      "open_source": {
        "self_host": "yes",
        "license": "Apache-2.0",
        "repo_url": "https://github.com/ory/kratos"
      },
      "ecosystem": {
        "github_repo": "ory/kratos",
        "github_stars": 13948,
        "npm_package": "@ory/elements-react",
        "npm_weekly_downloads": 23975,
        "measured_on": "2026-11-05"
      },
      "notes": "Ory ships separate open-source servers (Kratos for identities, Hydra for OAuth2, Polis for enterprise SSO) and a managed Ory Network. Passwordless email is a one-time code rather than a link, and the official MCP server answers questions from the documentation rather than managing projects, so both are partial. Enterprise SSO is SAML and OIDC through Polis, configured by the developer in the docs we read.",
      "score": 81,
      "score_breakdown": {
        "sdks": 8,
        "ui": 10,
        "methods": 16,
        "quickstart": 4,
        "local_dev": 10,
        "api": 17,
        "ai": 11,
        "open_source": 5
      },
      "changelog_fresh": false
    },
    {
      "key": "ciam/stytch",
      "name": "Stytch",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "python",
          "go",
          "node",
          "ruby",
          "java"
        ],
        "frontend": [
          "react",
          "nextjs",
          "react-native",
          "ios",
          "android"
        ],
        "sources": [
          {
            "title": "Backend SDKs",
            "url": "https://stytch.com/docs/api-reference/consumer/api/sdks"
          },
          {
            "title": "Next.js SDK overview",
            "url": "https://stytch.com/docs/api-reference/consumer/frontend-sdks/nextjs/overview"
          }
        ]
      },
      "ui": {
        "hosted_login": "unknown",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Prebuilt UI login configuration (React)",
            "url": "https://stytch.com/docs/api-reference/consumer/frontend-sdks/react/prebuilt-ui/login/configuration"
          },
          {
            "title": "Add Passkeys to Stytch Login (Passkey Registration component)",
            "url": "https://stytch.com/docs/consumer-auth/authentication/passkeys/login-sdk"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "yes",
        "scim": "yes",
        "sources": [
          {
            "title": "Passkeys overview",
            "url": "https://stytch.com/docs/consumer-auth/authentication/passkeys/overview"
          },
          {
            "title": "Admin Portal (self-serve SSO and SCIM)",
            "url": "https://stytch.com/docs/multi-tenant-auth/enterprise-ready/admin-portal"
          },
          {
            "title": "Admin Portal SCIM component",
            "url": "https://stytch.com/docs/api-reference/b2b/frontend-sdks/react/prebuilt-ui/admin-portal/scim"
          }
        ]
      },
      "quickstart": {
        "framework": "Selector (all frameworks)",
        "url": "https://stytch.com/docs/get-started/quickstart",
        "steps": null,
        "time_claim": "Get up and running with Stytch in minutes."
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Each Stytch project has a Test environment with its own project ID and secret, separate from Live.",
        "sources": [
          {
            "title": "Backend SDKs (Test environment keys)",
            "url": "https://stytch.com/docs/api-reference/consumer/api/sdks"
          },
          {
            "title": "Stytch pricing",
            "url": "https://stytch.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": null,
        "webhooks": "yes",
        "rate_limits_url": "https://stytch.com/docs/resources/policies/platform/rate-limits",
        "status_page_url": "https://status.stytch.com/",
        "changelog_url": "https://stytch.com/docs/resources/changelog",
        "changelog_last_entry": "2026-09-25",
        "sources": [
          {
            "title": "Rate limits",
            "url": "https://stytch.com/docs/resources/policies/platform/rate-limits"
          },
          {
            "title": "Changelog",
            "url": "https://stytch.com/docs/resources/changelog"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://mcp.stytch.dev/",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "partial",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://stytch.com/docs/llms.txt",
        "sources": [
          {
            "title": "MCP authorization overview",
            "url": "https://stytch.com/docs/connected-apps/guides/mcp-auth-overview"
          },
          {
            "title": "Integrate with AI agents",
            "url": "https://stytch.com/docs/connected-apps/guides/integrate-with-ai-agents"
          },
          {
            "title": "Authenticate an M2M client",
            "url": "https://stytch.com/docs/multi-tenant-auth/authentication/m2m/authenticate-client"
          }
        ]
      },
      "open_source": {
        "self_host": "no",
        "license": null,
        "repo_url": "https://github.com/stytchauth/stytch-node"
      },
      "ecosystem": {
        "github_repo": "stytchauth/stytch-node",
        "github_stars": 116,
        "npm_package": "@stytch/nextjs",
        "npm_weekly_downloads": 109434,
        "measured_on": "2026-11-05"
      },
      "notes": "The pay-as-you-go plan starts at $0 with 10,000 monthly active users and AI agents, 5 SSO or SCIM connections and 1,000 M2M tokens always free. Passkeys sign users in but cannot be used for sign-up; users first verify an email or phone. Token exchange is partial: the docs describe RFC 8693 requests only toward a workforce IdP in the Connected Apps cross-app flow, and no Management API OpenAPI file is linked from the docs.",
      "score": 79,
      "score_breakdown": {
        "sdks": 10,
        "ui": 7,
        "methods": 20,
        "quickstart": 2,
        "local_dev": 10,
        "api": 16,
        "ai": 14,
        "open_source": 0
      },
      "changelog_fresh": true
    },
    {
      "key": "ciam/kinde",
      "name": "Kinde",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "dotnet",
          "elixir",
          "go",
          "java",
          "node",
          "php",
          "python",
          "ruby"
        ],
        "frontend": [
          "nextjs",
          "react",
          "svelte",
          "ios",
          "android",
          "flutter",
          "react-native"
        ],
        "sources": [
          {
            "title": "Kinde SDKs",
            "url": "https://docs.kinde.com/developer-tools/about/our-sdks/"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "unknown",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Working with the Kinde widget (hosted pages)",
            "url": "https://docs.kinde.com/design/customize-with-code/kinde-widget/"
          },
          {
            "title": "Passkeys (post-login enrollment and account portal)",
            "url": "https://docs.kinde.com/authenticate/authentication-methods/passkeys/"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "partial",
        "social_login": "yes",
        "enterprise_sso": "yes",
        "scim": "no",
        "sources": [
          {
            "title": "Email authentication (OTP, no magic links)",
            "url": "https://docs.kinde.com/authenticate/authentication-methods/email-authentication/"
          },
          {
            "title": "Add SSO through the self-serve portal",
            "url": "https://docs.kinde.com/authenticate/self-serve-sso/add-sso-self-serve/"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://docs.kinde.com/developer-tools/sdks/backend/nextjs-sdk/",
        "steps": null,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Every Kinde business has a production environment and can add non-production environments with their own settings.",
        "sources": [
          {
            "title": "Manage Kinde environments",
            "url": "https://docs.kinde.com/build/environments/environments/"
          },
          {
            "title": "Kinde pricing",
            "url": "https://kinde.com/pricing/"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://api-spec.kinde.com/kinde-management-api-spec.yaml",
        "webhooks": "yes",
        "rate_limits_url": "https://docs.kinde.com/developer-tools/kinde-api/api-rate-limits/",
        "status_page_url": "https://status.kinde.com/",
        "changelog_url": "https://updates.kinde.com",
        "changelog_last_entry": "2026-10-30",
        "sources": [
          {
            "title": "Management API reference",
            "url": "https://docs.kinde.com/kinde-apis/management/"
          },
          {
            "title": "Add and manage webhooks",
            "url": "https://docs.kinde.com/integrate/webhooks/add-manage-webhooks/"
          },
          {
            "title": "Management API rate limits",
            "url": "https://docs.kinde.com/developer-tools/kinde-api/api-rate-limits/"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://docs.kinde.com/mcp-servers/manage-kinde-account-with-ai-agents/",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "unknown",
        "mcp_authorization": "unknown",
        "llms_txt_url": "https://docs.kinde.com/llms.txt",
        "sources": [
          {
            "title": "Manage your Kinde account with AI agents (Kinde MCP Server)",
            "url": "https://docs.kinde.com/mcp-servers/manage-kinde-account-with-ai-agents/"
          },
          {
            "title": "Using M2M apps for AI applications",
            "url": "https://docs.kinde.com/machine-to-machine-applications/organization-scoped-m2m-apps/using-m2m-apps-for-ai-applications/"
          },
          {
            "title": "About M2M applications",
            "url": "https://docs.kinde.com/machine-to-machine-applications/about-m2m/"
          }
        ]
      },
      "open_source": {
        "self_host": "no",
        "license": null,
        "repo_url": "https://github.com/kinde-oss/kinde-auth-nextjs"
      },
      "ecosystem": {
        "github_repo": "kinde-oss/kinde-auth-nextjs",
        "github_stars": 184,
        "npm_package": "@kinde-oss/kinde-auth-nextjs",
        "npm_weekly_downloads": 62718,
        "measured_on": "2026-11-05"
      },
      "notes": "The Free plan includes 10,500 monthly active users; the Plus plan advertises free enterprise SSO. Kinde says it sends email one-time codes and does not support magic links, and its docs list SCIM as coming soon. Self-serve SSO covers SAML connections; OIDC providers are added as custom OAuth2/OIDC connections. The Kinde MCP Server authenticates with an environment API key and can read and create but not modify or delete; the Next.js page is an SDK guide without numbered steps.",
      "score": 76,
      "score_breakdown": {
        "sdks": 13,
        "ui": 6,
        "methods": 14,
        "quickstart": 2,
        "local_dev": 10,
        "api": 20,
        "ai": 11,
        "open_source": 0
      },
      "changelog_fresh": true
    },
    {
      "key": "open-source/zitadel",
      "name": "ZITADEL",
      "kind": "open-source",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "go",
          "node",
          "php",
          "python",
          "ruby",
          "dotnet"
        ],
        "frontend": [
          "react",
          "angular"
        ],
        "sources": [
          {
            "title": "SDK examples and client libraries",
            "url": "https://zitadel.com/docs/sdk-examples/introduction"
          },
          {
            "title": "ZITADEL Go client library",
            "url": "https://github.com/zitadel/zitadel-go"
          },
          {
            "title": "Official ZITADEL auth integration for React",
            "url": "https://github.com/zitadel/zitadel-react"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "no",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Login UI (hosted, or fork and deploy the login app)",
            "url": "https://zitadel.com/docs/guides/integrate/login-ui"
          },
          {
            "title": "Passkeys",
            "url": "https://zitadel.com/docs/concepts/features/passkeys"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "partial",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "yes",
        "sources": [
          {
            "title": "Passkeys",
            "url": "https://zitadel.com/docs/concepts/features/passkeys"
          },
          {
            "title": "SCIM v2 API",
            "url": "https://zitadel.com/docs/apis/scim2"
          },
          {
            "title": "Login UI: external login",
            "url": "https://zitadel.com/docs/guides/integrate/login-ui/external-login"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js (Auth.js example)",
        "url": "https://zitadel.com/docs/sdk-examples/nextjs",
        "steps": 9,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "ZITADEL documents a Docker Compose deployment for running the server locally, and ZITADEL Cloud has a free tier.",
        "sources": [
          {
            "title": "Deploy with Docker Compose",
            "url": "https://zitadel.com/docs/self-hosting/deploy/compose"
          },
          {
            "title": "ZITADEL pricing",
            "url": "https://zitadel.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://zitadel.com/docs/reference/api/management",
        "webhooks": "yes",
        "rate_limits_url": "https://zitadel.com/docs/legal/policies/rate-limit-policy",
        "status_page_url": "https://status.zitadel.com",
        "changelog_url": "https://github.com/zitadel/zitadel/releases",
        "changelog_last_entry": "2026-11-03",
        "sources": [
          {
            "title": "Management API (OpenAPI docs)",
            "url": "https://zitadel.com/docs/reference/api/management"
          },
          {
            "title": "Actions v2 (webhook targets)",
            "url": "https://zitadel.com/docs/concepts/features/actions_v2"
          },
          {
            "title": "Rate limit policy",
            "url": "https://zitadel.com/docs/legal/policies/rate-limit-policy"
          }
        ]
      },
      "ai": {
        "mcp_server": "unknown",
        "mcp_server_url": null,
        "agent_auth_docs": "unknown",
        "m2m_tokens": "yes",
        "token_exchange": "yes",
        "mcp_authorization": "yes",
        "llms_txt_url": null,
        "sources": [
          {
            "title": "Client credentials for service accounts",
            "url": "https://zitadel.com/docs/guides/integrate/service-accounts/client-credentials"
          },
          {
            "title": "Token exchange",
            "url": "https://zitadel.com/docs/guides/integrate/token-exchange"
          },
          {
            "title": "Dynamic client registration (MCP clients)",
            "url": "https://zitadel.com/docs/guides/integrate/dynamic-client-registration"
          }
        ]
      },
      "open_source": {
        "self_host": "yes",
        "license": "AGPL-3.0",
        "repo_url": "https://github.com/zitadel/zitadel"
      },
      "ecosystem": {
        "github_repo": "zitadel/zitadel",
        "github_stars": 15524,
        "npm_package": "@zitadel/react",
        "npm_weekly_downloads": 9714,
        "measured_on": "2026-11-05"
      },
      "notes": "Passwordless email is a one-time code (OTP Email) rather than a link, and SAML and OIDC identity providers are configured by instance or organization administrators, so both are partial. The Next.js guide uses Auth.js rather than a ZITADEL SDK; the Java client repository is archived and not counted. The docs publish llms-full.txt but no llms.txt index.",
      "score": 74,
      "score_breakdown": {
        "sdks": 8,
        "ui": 6,
        "methods": 16,
        "quickstart": 3,
        "local_dev": 10,
        "api": 20,
        "ai": 6,
        "open_source": 5
      },
      "changelog_fresh": true
    },
    {
      "key": "ciam/supertokens",
      "name": "SuperTokens",
      "kind": "open-source",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "python",
          "go"
        ],
        "frontend": [
          "react",
          "nextjs",
          "ios",
          "android",
          "flutter",
          "react-native"
        ],
        "sources": [
          {
            "title": "Quickstart guide",
            "url": "https://supertokens.com/docs/quickstart"
          },
          {
            "title": "Frontend SDK reference",
            "url": "https://supertokens.com/docs/references/frontend-sdks/reference"
          }
        ]
      },
      "ui": {
        "hosted_login": "unknown",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Override pre-built React components",
            "url": "https://supertokens.com/docs/references/frontend-sdks/prebuilt-ui/override-react-components"
          },
          {
            "title": "Set up passkey authentication (pre-built UI)",
            "url": "https://supertokens.com/docs/authentication/passkeys/initial-setup"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "unknown",
        "sources": [
          {
            "title": "Passkey authentication",
            "url": "https://supertokens.com/docs/authentication/passkeys/introduction"
          },
          {
            "title": "Passwordless setup for magic link login and OTPs",
            "url": "https://supertokens.com/docs/authentication/passwordless/initial-setup"
          },
          {
            "title": "Enterprise (multi-tenant) login",
            "url": "https://supertokens.com/docs/authentication/enterprise/introduction"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://supertokens.com/docs/quickstart",
        "steps": 6,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "The SuperTokens core can be self-hosted for free, and paid features can be tested for free on development core instances.",
        "sources": [
          {
            "title": "Self-host SuperTokens",
            "url": "https://supertokens.com/docs/deployment/self-host-supertokens"
          },
          {
            "title": "SuperTokens pricing",
            "url": "https://supertokens.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://github.com/supertokens/core-driver-interface",
        "webhooks": "unknown",
        "rate_limits_url": "https://supertokens.com/docs/deployment/rate-limits",
        "status_page_url": null,
        "changelog_url": "https://github.com/supertokens/supertokens-core/releases",
        "changelog_last_entry": "2026-11-05",
        "sources": [
          {
            "title": "Core Driver Interface (API spec)",
            "url": "https://github.com/supertokens/core-driver-interface"
          },
          {
            "title": "Rate limit policy",
            "url": "https://supertokens.com/docs/deployment/rate-limits"
          }
        ]
      },
      "ai": {
        "mcp_server": "partial",
        "mcp_server_url": "https://supertokens.com/docs/integrate-with-ai",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "unknown",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://supertokens.com/docs/llms.txt",
        "sources": [
          {
            "title": "Integrate with AI (documentation MCP server)",
            "url": "https://supertokens.com/docs/integrate-with-ai"
          },
          {
            "title": "MCP authentication (beta)",
            "url": "https://supertokens.com/docs/authentication/ai-authentication"
          },
          {
            "title": "M2M client credentials flow",
            "url": "https://supertokens.com/docs/authentication/m2m/client-credentials"
          }
        ]
      },
      "open_source": {
        "self_host": "yes",
        "license": null,
        "repo_url": "https://github.com/supertokens/supertokens-core"
      },
      "ecosystem": {
        "github_repo": "supertokens/supertokens-core",
        "github_stars": 15343,
        "npm_package": "supertokens-auth-react",
        "npm_weekly_downloads": 130103,
        "measured_on": "2026-11-05"
      },
      "notes": "The managed service is free under 5,000 monthly active users and self-hosting the open-source features is free; multi-tenant enterprise login (SAML and OIDC) is a paid feature configured per tenant by the developer. The official MCP server is a read-only documentation server, so it scores partial, and MCP authentication is labelled beta. The GitHub API reports the core license as NOASSERTION, so no license is scored.",
      "score": 72,
      "score_breakdown": {
        "sdks": 9,
        "ui": 7,
        "methods": 14,
        "quickstart": 4,
        "local_dev": 10,
        "api": 14,
        "ai": 11,
        "open_source": 3
      },
      "changelog_fresh": true
    },
    {
      "key": "ciam/authgear",
      "name": "Authgear",
      "kind": "open-source",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node"
        ],
        "frontend": [
          "nextjs",
          "ios",
          "android",
          "flutter",
          "react-native"
        ],
        "sources": [
          {
            "title": "Start building (SDK guides)",
            "url": "https://docs.authgear.com/get-started/start-building"
          },
          {
            "title": "Authgear GitHub organization",
            "url": "https://github.com/authgear"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "no",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Built-in UI",
            "url": "https://docs.authgear.com/customization/built-in-ui"
          },
          {
            "title": "Add passkeys login (passkey upsell screen)",
            "url": "https://docs.authgear.com/authentication-and-access/authentication/passkeys"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "unknown",
        "sources": [
          {
            "title": "Add passkeys login",
            "url": "https://docs.authgear.com/authentication-and-access/authentication/passkeys"
          },
          {
            "title": "Add email magic link login",
            "url": "https://docs.authgear.com/authentication-and-access/authentication/add-email-magic-link-login"
          },
          {
            "title": "Enterprise login providers",
            "url": "https://docs.authgear.com/authentication-and-access/social-enterprise-login-providers/enterprise-login-providers"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://docs.authgear.com/get-started/regular-web-app/nextjs",
        "steps": 4,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Authgear documents running the server locally with Docker Compose, and the open-source server and the cloud Free plan cost nothing.",
        "sources": [
          {
            "title": "Run locally with Docker Compose",
            "url": "https://docs.authgear.com/deployment/local"
          },
          {
            "title": "Authgear pricing",
            "url": "https://www.authgear.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": null,
        "webhooks": "yes",
        "rate_limits_url": "https://docs.authgear.com/reference/rate-limits",
        "status_page_url": "https://status.authgear.com",
        "changelog_url": "https://github.com/authgear/authgear-server/releases",
        "changelog_last_entry": "2026-10-22",
        "sources": [
          {
            "title": "Admin API (GraphQL)",
            "url": "https://docs.authgear.com/reference/apis/admin-api"
          },
          {
            "title": "Events and hooks",
            "url": "https://docs.authgear.com/customization/events-hooks"
          },
          {
            "title": "Rate limits",
            "url": "https://docs.authgear.com/reference/rate-limits"
          }
        ]
      },
      "ai": {
        "mcp_server": "unknown",
        "mcp_server_url": null,
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "unknown",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://docs.authgear.com/llms.txt",
        "sources": [
          {
            "title": "Auth for MCP",
            "url": "https://docs.authgear.com/get-started/auth-for-mcp"
          },
          {
            "title": "Dynamic client registration (DCR)",
            "url": "https://docs.authgear.com/get-started/auth-for-mcp/dynamic-client-registration"
          },
          {
            "title": "Machine-to-machine applications",
            "url": "https://docs.authgear.com/get-started/m2m-applications"
          }
        ]
      },
      "open_source": {
        "self_host": "yes",
        "license": "Apache-2.0",
        "repo_url": "https://github.com/authgear/authgear-server"
      },
      "ecosystem": {
        "github_repo": "authgear/authgear-server",
        "github_stars": 2143,
        "npm_package": "@authgear/web",
        "npm_weekly_downloads": 3265,
        "measured_on": "2026-11-05"
      },
      "notes": "The cloud Free plan lists unlimited MAUs, and the Apache-2.0 server can be self-hosted. Sign-in uses Authgear's hosted built-in UI, which prompts users to create a passkey; there are no embeddable components. Enterprise login providers cover Microsoft Entra ID, AD FS and Azure AD B2C configured by the developer, and the Admin API is GraphQL, so no OpenAPI file applies.",
      "score": 71,
      "score_breakdown": {
        "sdks": 6,
        "ui": 6,
        "methods": 14,
        "quickstart": 5,
        "local_dev": 10,
        "api": 16,
        "ai": 9,
        "open_source": 5
      },
      "changelog_fresh": true
    },
    {
      "key": "ciam/amazon-cognito",
      "name": "Amazon Cognito",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "python",
          "go",
          "java",
          "dotnet",
          "ruby",
          "php",
          "rust"
        ],
        "frontend": [
          "react",
          "nextjs",
          "vue",
          "angular",
          "ios",
          "android",
          "flutter",
          "react-native"
        ],
        "sources": [
          {
            "title": "Tools to build on AWS (AWS SDKs)",
            "url": "https://aws.amazon.com/developer/tools/"
          },
          {
            "title": "AWS Amplify documentation",
            "url": "https://docs.amplify.aws/"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "unknown",
        "sources": [
          {
            "title": "Managed login",
            "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managed-login.html"
          },
          {
            "title": "Amplify UI Authenticator (React)",
            "url": "https://ui.docs.amplify.aws/react/connected-components/authenticator"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "partial",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "unknown",
        "sources": [
          {
            "title": "Authentication flows (passwordless OTP and WebAuthn passkeys)",
            "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow-methods.html"
          },
          {
            "title": "Social identity providers",
            "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-social-idp.html"
          },
          {
            "title": "SAML providers",
            "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-saml-idp.html"
          },
          {
            "title": "OIDC providers",
            "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-oidc-idp.html"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js (Amplify)",
        "url": "https://docs.amplify.aws/nextjs/start/quickstart/",
        "steps": 3,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Amplify provides per-developer cloud sandbox environments; there is no local Cognito emulator.",
        "sources": [
          {
            "title": "Amplify cloud sandbox environments",
            "url": "https://docs.amplify.aws/nextjs/deploy-and-host/sandbox-environments/setup/"
          },
          {
            "title": "Amazon Cognito pricing",
            "url": "https://aws.amazon.com/cognito/pricing/"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": null,
        "webhooks": "partial",
        "rate_limits_url": "https://docs.aws.amazon.com/cognito/latest/developerguide/quotas.html",
        "status_page_url": "https://health.aws.amazon.com/health/status",
        "changelog_url": "https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-document-history.html",
        "changelog_last_entry": "2026-11-02",
        "sources": [
          {
            "title": "Lambda triggers",
            "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html"
          },
          {
            "title": "Quotas",
            "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/quotas.html"
          },
          {
            "title": "Document history",
            "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-document-history.html"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://awslabs.github.io/mcp/servers/aws-api-mcp-server",
        "agent_auth_docs": "unknown",
        "m2m_tokens": "yes",
        "token_exchange": "unknown",
        "mcp_authorization": "unknown",
        "llms_txt_url": "https://docs.aws.amazon.com/llms.txt",
        "sources": [
          {
            "title": "AWS API MCP Server (AWS Labs)",
            "url": "https://awslabs.github.io/mcp/servers/aws-api-mcp-server"
          },
          {
            "title": "M2M and scopes",
            "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-define-resource-servers.html"
          }
        ]
      },
      "open_source": {
        "self_host": "no",
        "license": null,
        "repo_url": "https://github.com/aws-amplify/amplify-js"
      },
      "ecosystem": {
        "github_repo": "aws-amplify/amplify-js",
        "github_stars": 9554,
        "npm_package": "aws-amplify",
        "npm_weekly_downloads": 2375797,
        "measured_on": "2026-11-05"
      },
      "notes": "Passkey and passwordless sign-in need managed login and a feature plan above Lite; passwordless email is a one-time code, not a link. SAML and OIDC providers are configured by the developer per user pool, with no customer-facing SSO setup. Webhooks are partial because events go to Lambda triggers rather than HTTP endpoints; the MCP server is the general AWS API MCP server, and the npm figure covers all of Amplify, not Cognito alone.",
      "score": 70,
      "score_breakdown": {
        "sdks": 14,
        "ui": 7,
        "methods": 12,
        "quickstart": 5,
        "local_dev": 10,
        "api": 14,
        "ai": 8,
        "open_source": 0
      },
      "changelog_fresh": true
    },
    {
      "key": "open-source/supabase-auth",
      "name": "Supabase Auth",
      "kind": "open-source",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "python"
        ],
        "frontend": [
          "nextjs",
          "ios",
          "flutter"
        ],
        "sources": [
          {
            "title": "Supabase docs index (client library references)",
            "url": "https://supabase.com/llms.txt"
          },
          {
            "title": "Creating a Supabase client for SSR",
            "url": "https://supabase.com/docs/guides/auth/server-side/creating-a-client"
          }
        ]
      },
      "ui": {
        "hosted_login": "unknown",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "unknown",
        "sources": [
          {
            "title": "Supabase UI Library: password-based auth (Next.js)",
            "url": "https://supabase.com/ui/docs/nextjs/password-based-auth"
          }
        ]
      },
      "methods": {
        "passkeys": "partial",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "unknown",
        "sources": [
          {
            "title": "Passkey authentication (experimental)",
            "url": "https://supabase.com/docs/guides/auth/passkeys"
          },
          {
            "title": "Passwordless email logins",
            "url": "https://supabase.com/docs/guides/auth/auth-email-passwordless"
          },
          {
            "title": "SAML 2.0 single sign-on",
            "url": "https://supabase.com/docs/guides/auth/enterprise-sso/auth-sso-saml"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://supabase.com/docs/guides/auth/quickstarts/nextjs",
        "steps": 4,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "The Supabase CLI runs the full stack, including Auth, locally, and the server is open source and self-hostable.",
        "sources": [
          {
            "title": "Local development with the CLI",
            "url": "https://supabase.com/docs/guides/local-development"
          },
          {
            "title": "Supabase pricing",
            "url": "https://supabase.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://api.supabase.com/api/v1-json",
        "webhooks": "partial",
        "rate_limits_url": "https://supabase.com/docs/guides/auth/rate-limits",
        "status_page_url": "https://status.supabase.com",
        "changelog_url": "https://supabase.com/changelog",
        "changelog_last_entry": "2026-11-04",
        "sources": [
          {
            "title": "Auth hooks",
            "url": "https://supabase.com/docs/guides/auth/auth-hooks"
          },
          {
            "title": "Auth rate limits",
            "url": "https://supabase.com/docs/guides/auth/rate-limits"
          },
          {
            "title": "Management API reference",
            "url": "https://supabase.com/llms/api.txt"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://supabase.com/docs/guides/getting-started/mcp",
        "agent_auth_docs": "yes",
        "m2m_tokens": "no",
        "token_exchange": "unknown",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://supabase.com/llms.txt",
        "sources": [
          {
            "title": "Supabase MCP server",
            "url": "https://supabase.com/docs/guides/getting-started/mcp"
          },
          {
            "title": "OAuth 2.1 server: MCP authentication",
            "url": "https://supabase.com/docs/guides/auth/oauth-server/mcp-authentication"
          },
          {
            "title": "OAuth server flows (client_credentials not supported)",
            "url": "https://supabase.com/docs/guides/auth/oauth-server/oauth-flows"
          }
        ]
      },
      "open_source": {
        "self_host": "yes",
        "license": "MIT",
        "repo_url": "https://github.com/supabase/auth"
      },
      "ecosystem": {
        "github_repo": "supabase/auth",
        "github_stars": 2594,
        "npm_package": "@supabase/supabase-js",
        "npm_weekly_downloads": 67116419,
        "measured_on": "2026-11-05"
      },
      "notes": "Supabase Auth is part of the Supabase platform; the npm figure is for the whole supabase-js client, not Auth alone. Passkeys are labelled experimental and need an explicit client opt-in, and enterprise SSO is SAML 2.0 configured by the developer, so both are partial. The OAuth 2.1 server can authorize MCP clients but does not support the client_credentials grant; the Kotlin and C# libraries are community-maintained and not counted.",
      "score": 70,
      "score_breakdown": {
        "sdks": 5,
        "ui": 4,
        "methods": 12,
        "quickstart": 5,
        "local_dev": 10,
        "api": 18,
        "ai": 11,
        "open_source": 5
      },
      "changelog_fresh": true
    },
    {
      "key": "open-source/better-auth",
      "name": "Better Auth",
      "kind": "library",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node"
        ],
        "frontend": [
          "react",
          "nextjs",
          "vue",
          "svelte",
          "react-native"
        ],
        "sources": [
          {
            "title": "Client (framework clients)",
            "url": "https://better-auth.com/docs/concepts/client"
          },
          {
            "title": "Next.js integration",
            "url": "https://better-auth.com/docs/integrations/next"
          },
          {
            "title": "Expo integration",
            "url": "https://better-auth.com/docs/integrations/expo"
          }
        ]
      },
      "ui": {
        "hosted_login": "no",
        "embeddable_components": "no",
        "passkey_enrollment_ui": "no",
        "sources": [
          {
            "title": "Installation",
            "url": "https://better-auth.com/docs/installation"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "yes",
        "scim": "yes",
        "sources": [
          {
            "title": "Passkey plugin",
            "url": "https://better-auth.com/docs/plugins/passkey"
          },
          {
            "title": "Magic link plugin",
            "url": "https://better-auth.com/docs/plugins/magic-link"
          },
          {
            "title": "Single Sign-On (SSO) plugin",
            "url": "https://better-auth.com/docs/plugins/sso"
          },
          {
            "title": "SCIM plugin",
            "url": "https://better-auth.com/docs/plugins/scim"
          }
        ]
      },
      "quickstart": {
        "framework": "Any (installation guide)",
        "url": "https://better-auth.com/docs/installation",
        "steps": 9,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Better Auth is a library that runs inside your app against your own database, so local development needs no external service.",
        "sources": [
          {
            "title": "Installation",
            "url": "https://better-auth.com/docs/installation"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://better-auth.com/docs/plugins/open-api",
        "webhooks": "unknown",
        "rate_limits_url": "https://better-auth.com/docs/concepts/rate-limit",
        "status_page_url": null,
        "changelog_url": "https://github.com/better-auth/better-auth/releases",
        "changelog_last_entry": "2026-11-05",
        "sources": [
          {
            "title": "Open API plugin",
            "url": "https://better-auth.com/docs/plugins/open-api"
          },
          {
            "title": "Rate limit",
            "url": "https://better-auth.com/docs/concepts/rate-limit"
          }
        ]
      },
      "ai": {
        "mcp_server": "partial",
        "mcp_server_url": "https://better-auth.com/docs/ai-resources/mcp",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "unknown",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://better-auth.com/llms.txt",
        "sources": [
          {
            "title": "Documentation MCP server",
            "url": "https://better-auth.com/docs/ai-resources/mcp"
          },
          {
            "title": "MCP plugin",
            "url": "https://better-auth.com/docs/plugins/mcp"
          },
          {
            "title": "Agent Auth plugin",
            "url": "https://better-auth.com/docs/plugins/agent-auth"
          },
          {
            "title": "OAuth provider: tokens (client_credentials)",
            "url": "https://better-auth.com/docs/plugins/oauth-provider/tokens"
          }
        ]
      },
      "open_source": {
        "self_host": "yes",
        "license": "MIT",
        "repo_url": "https://github.com/better-auth/better-auth"
      },
      "ecosystem": {
        "github_repo": "better-auth/better-auth",
        "github_stars": 30606,
        "npm_package": "better-auth",
        "npm_weekly_downloads": 18540314,
        "measured_on": "2026-11-05"
      },
      "notes": "Better Auth is a TypeScript library with plugins, not a hosted service, so it ships no sign-in pages or UI components; you build the forms. Self-service SSO, where a customer configures its own connection through an onboarding link, needs the paid Better Auth Infrastructure service; the open-source SSO plugin covers SAML 2.0 and OIDC per organization. The official MCP server serves documentation only, which scores partial.",
      "score": 69,
      "score_breakdown": {
        "sdks": 6,
        "ui": 0,
        "methods": 20,
        "quickstart": 3,
        "local_dev": 10,
        "api": 14,
        "ai": 11,
        "open_source": 5
      },
      "changelog_fresh": true
    },
    {
      "key": "open-source/stack-auth",
      "name": "Hexclave (formerly Stack Auth)",
      "kind": "open-source",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node"
        ],
        "frontend": [
          "react",
          "nextjs"
        ],
        "sources": [
          {
            "title": "Setup (SDK packages for Next.js, React, JS)",
            "url": "https://docs.hexclave.com/guides/getting-started/setup"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Authentication overview (hosted pages, SignIn, SignUp, AccountSettings)",
            "url": "https://docs.hexclave.com/guides/apps/authentication/overview"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "unknown",
        "sources": [
          {
            "title": "Auth providers",
            "url": "https://docs.hexclave.com/guides/apps/authentication/auth-providers"
          },
          {
            "title": "Passkey",
            "url": "https://docs.hexclave.com/guides/apps/authentication/auth-providers/passkey"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://docs.hexclave.com/guides/getting-started/setup",
        "steps": 6,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "The Hexclave CLI dev command runs a development environment and injects project keys; the pricing page offers a free start and $0 self-hosting.",
        "sources": [
          {
            "title": "Hexclave CLI",
            "url": "https://docs.hexclave.com/guides/going-further/cli"
          },
          {
            "title": "Hexclave pricing",
            "url": "https://www.hexclave.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://docs.hexclave.com/openapi/server.json",
        "webhooks": "yes",
        "rate_limits_url": null,
        "status_page_url": "https://status.hexclave.com",
        "changelog_url": "https://github.com/hexclave/hexclave/releases",
        "changelog_last_entry": "2026-10-30",
        "sources": [
          {
            "title": "REST API overview",
            "url": "https://docs.hexclave.com/api/overview"
          },
          {
            "title": "Webhooks",
            "url": "https://docs.hexclave.com/guides/apps/webhooks/overview"
          }
        ]
      },
      "ai": {
        "mcp_server": "partial",
        "mcp_server_url": "https://mcp.hexclave.com",
        "agent_auth_docs": "unknown",
        "m2m_tokens": "unknown",
        "token_exchange": "unknown",
        "mcp_authorization": "unknown",
        "llms_txt_url": "https://docs.hexclave.com/llms.txt",
        "sources": [
          {
            "title": "Hexclave MCP setup (documentation server)",
            "url": "https://mcp.hexclave.com"
          }
        ]
      },
      "open_source": {
        "self_host": "yes",
        "license": null,
        "repo_url": "https://github.com/hexclave/hexclave"
      },
      "ecosystem": {
        "github_repo": "hexclave/hexclave",
        "github_stars": 6886,
        "npm_package": "@hexclave/next",
        "npm_weekly_downloads": 18748,
        "measured_on": "2026-11-05"
      },
      "notes": "Hexclave's docs state that Stack Auth is now Hexclave, with the dashboard, APIs and data unchanged; stack-auth.com redirects to hexclave.com and the GitHub repository moved to hexclave/hexclave. Enterprise login is custom OIDC providers (no SAML documented), and the official MCP server serves documentation and Q&A, so both are partial. The GitHub API reports the license as NOASSERTION, so no license is scored; npm downloads are for the renamed @hexclave/next package and exclude the older @stackframe packages.",
      "score": 65,
      "score_breakdown": {
        "sdks": 3,
        "ui": 10,
        "methods": 14,
        "quickstart": 4,
        "local_dev": 10,
        "api": 17,
        "ai": 4,
        "open_source": 3
      },
      "changelog_fresh": true
    },
    {
      "key": "ciam/propelauth",
      "name": "PropelAuth",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "python",
          "go",
          "rust",
          "dotnet"
        ],
        "frontend": [
          "react",
          "nextjs"
        ],
        "sources": [
          {
            "title": "Reference documentation (libraries)",
            "url": "https://docs.propelauth.com/reference"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "no",
        "passkey_enrollment_ui": "unknown",
        "sources": [
          {
            "title": "Hosted pages",
            "url": "https://docs.propelauth.com/overview/basics/hosted-pages"
          }
        ]
      },
      "methods": {
        "passkeys": "unknown",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "yes",
        "scim": "yes",
        "sources": [
          {
            "title": "Login methods (passwordless and magic links)",
            "url": "https://docs.propelauth.com/overview/authentication/login-methods"
          },
          {
            "title": "Enterprise SSO (SAML and OIDC)",
            "url": "https://docs.propelauth.com/overview/authentication/saml"
          },
          {
            "title": "PropelAuth pricing (SCIM, SSO)",
            "url": "https://www.propelauth.com/pricing"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js (App Router)",
        "url": "https://docs.propelauth.com/getting-started",
        "steps": null,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Every PropelAuth project gets a Test environment with its own Auth URL, recommended for local development, plus Staging and Production.",
        "sources": [
          {
            "title": "Environments",
            "url": "https://docs.propelauth.com/overview/basics/environments"
          },
          {
            "title": "PropelAuth pricing",
            "url": "https://www.propelauth.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": null,
        "webhooks": "yes",
        "rate_limits_url": null,
        "status_page_url": "https://status.propelauth.com",
        "changelog_url": "https://docs.propelauth.com/changelog",
        "changelog_last_entry": "2026-10",
        "sources": [
          {
            "title": "User APIs",
            "url": "https://docs.propelauth.com/reference/api/user"
          },
          {
            "title": "Webhooks",
            "url": "https://docs.propelauth.com/integrations/webhooks"
          },
          {
            "title": "Changelog",
            "url": "https://docs.propelauth.com/changelog"
          }
        ]
      },
      "ai": {
        "mcp_server": "partial",
        "mcp_server_url": "https://docs.propelauth.com/getting-started/integration-mcp-server",
        "agent_auth_docs": "yes",
        "m2m_tokens": "partial",
        "token_exchange": "unknown",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://www.propelauth.com/llms.txt",
        "sources": [
          {
            "title": "PropelAuth Integration MCP Server",
            "url": "https://docs.propelauth.com/getting-started/integration-mcp-server"
          },
          {
            "title": "MCP authentication",
            "url": "https://docs.propelauth.com/mcp-authentication/overview"
          },
          {
            "title": "API key authentication (M2M)",
            "url": "https://docs.propelauth.com/api-key-authentication"
          }
        ]
      },
      "open_source": {
        "self_host": "partial",
        "license": null,
        "repo_url": "https://github.com/PropelAuth/javascript"
      },
      "ecosystem": {
        "github_repo": "PropelAuth/javascript",
        "github_stars": 7,
        "npm_package": "@propelauth/nextjs",
        "npm_weekly_downloads": 51759,
        "measured_on": "2026-11-05"
      },
      "notes": "The Free plan includes 10,000 MAUs; unlimited SAML and OIDC enterprise SSO, API keys and M2M, MCP authentication and a separate staging environment start on Growth ( a month), and organizations can be allowed to set up their own SAML or OIDC connection. The Integration MCP Server helps a coding agent integrate PropelAuth rather than manage a project, so it scores partial, and M2M uses PropelAuth API keys rather than an OAuth client credentials grant. Self-hosting is offered only as PropelAuth BYO for on-prem or private cloud deployments; the docs index lists no passkey login method.",
      "score": 62.5,
      "score_breakdown": {
        "sdks": 7,
        "ui": 3,
        "methods": 16,
        "quickstart": 2,
        "local_dev": 10,
        "api": 13,
        "ai": 10,
        "open_source": 1.5
      },
      "changelog_fresh": true
    },
    {
      "key": "ciam/ssojet",
      "name": "SSOJet",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node"
        ],
        "frontend": [
          "react"
        ],
        "sources": [
          {
            "title": "SSOJet Node.js server SDK",
            "url": "https://github.com/ssojet/ssojet-server-js"
          },
          {
            "title": "SSOJet SSOKit (React team management widgets)",
            "url": "https://github.com/ssojet/ssokit"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "partial",
        "passkey_enrollment_ui": "unknown",
        "sources": [
          {
            "title": "Hosted login page",
            "url": "https://ssojet.com/docs/en/branding/hosted-login-page"
          },
          {
            "title": "SSOKit drop-in React widgets",
            "url": "https://github.com/ssojet/ssokit"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "yes",
        "sources": [
          {
            "title": "Passkeys",
            "url": "https://ssojet.com/docs/en/authentication/passkeys-authentication"
          },
          {
            "title": "Magic link authentication",
            "url": "https://ssojet.com/docs/en/authentication/magicklink"
          },
          {
            "title": "Social authentication",
            "url": "https://ssojet.com/docs/en/authentication/social-authentication"
          },
          {
            "title": "Enterprise SSO",
            "url": "https://ssojet.com/docs/en/enterprise-sso"
          },
          {
            "title": "Directory Sync (SCIM)",
            "url": "https://ssojet.com/docs/en/enterprise-sso/directory-sync"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js (oidc-client-ts)",
        "url": "https://ssojet.com/docs/en/getting-started/fullstack/nextjs",
        "steps": 4,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "partial",
        "free_tier": "yes",
        "note": "The docs recommend testing flows in a sandbox tenant against a sandbox IdP, and SSOJet publishes a mock IdP; the Free plan is free forever with unlimited users.",
        "sources": [
          {
            "title": "Connection testing",
            "url": "https://ssojet.com/docs/en/enterprise-sso/connection-testing"
          },
          {
            "title": "SSOJet pricing",
            "url": "https://ssojet.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": null,
        "webhooks": "yes",
        "rate_limits_url": "https://ssojet.com/docs/en/references/rate-limits",
        "status_page_url": "https://status.ssojet.com",
        "changelog_url": null,
        "changelog_last_entry": null,
        "sources": [
          {
            "title": "API reference",
            "url": "https://ssojet.com/docs/en/api"
          },
          {
            "title": "Webhooks",
            "url": "https://ssojet.com/docs/en/integrations/webhooks"
          },
          {
            "title": "Rate limits",
            "url": "https://ssojet.com/docs/en/references/rate-limits"
          }
        ]
      },
      "ai": {
        "mcp_server": "partial",
        "mcp_server_url": "https://ssojet.com/docs/en/ai-identity/mcp-integration",
        "agent_auth_docs": "yes",
        "m2m_tokens": "yes",
        "token_exchange": "unknown",
        "mcp_authorization": "yes",
        "llms_txt_url": "https://ssojet.com/docs/llms.txt",
        "sources": [
          {
            "title": "MCP integration (SSOJet Docs MCP)",
            "url": "https://ssojet.com/docs/en/ai-identity/mcp-integration"
          },
          {
            "title": "MCP remote server with SSOJet auth",
            "url": "https://ssojet.com/docs/en/ai-identity/mcp-remote-server"
          },
          {
            "title": "AI identity overview",
            "url": "https://ssojet.com/docs/en/ai-identity"
          },
          {
            "title": "Machine-to-machine authentication",
            "url": "https://ssojet.com/docs/en/authentication/machine-to-machine-authentication"
          }
        ]
      },
      "open_source": {
        "self_host": "unknown",
        "license": null,
        "repo_url": "https://github.com/ssojet/ssojet-server-js"
      },
      "ecosystem": {
        "github_repo": "ssojet/ssojet-server-js",
        "github_stars": 0,
        "npm_package": "@ssojet/server-js",
        "npm_weekly_downloads": 8,
        "measured_on": "2026-11-05"
      },
      "notes": "SSOJet bills on active enterprise SSO connections: the Free plan is free forever for unlimited users and MAUs, and paid plans are priced per SSO and SCIM connection. The Next.js guide integrates over OIDC with oidc-client-ts or Auth.js rather than a Next.js SDK, the React widgets cover team management rather than sign-in, and the official MCP server serves documentation, so those score partial. No customer self-service SSO setup flow and no product changelog were found in the docs.",
      "score": 61.5,
      "score_breakdown": {
        "sdks": 2,
        "ui": 5,
        "methods": 18,
        "quickstart": 5,
        "local_dev": 7.5,
        "api": 13,
        "ai": 11,
        "open_source": 0
      },
      "changelog_fresh": false
    },
    {
      "key": "open-source/authentik",
      "name": "authentik",
      "kind": "open-source",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "go",
          "node",
          "python"
        ],
        "frontend": [],
        "sources": [
          {
            "title": "authentik Go API client",
            "url": "https://github.com/goauthentik/client-go"
          },
          {
            "title": "authentik TypeScript API client",
            "url": "https://github.com/goauthentik/client-ts"
          },
          {
            "title": "authentik Python API client",
            "url": "https://github.com/goauthentik/client-python"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "no",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Customize a flow (flow interface)",
            "url": "https://docs.goauthentik.io/customize/interfaces/flow"
          },
          {
            "title": "WebAuthn / FIDO2 / Passkeys authenticator setup stage",
            "url": "https://docs.goauthentik.io/add-secure-apps/flows-stages/stages/authenticator_webauthn"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "unknown",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "yes",
        "sources": [
          {
            "title": "WebAuthn / FIDO2 / Passkeys authenticator setup stage",
            "url": "https://docs.goauthentik.io/add-secure-apps/flows-stages/stages/authenticator_webauthn"
          },
          {
            "title": "Email stage",
            "url": "https://docs.goauthentik.io/add-secure-apps/flows-stages/stages/email"
          },
          {
            "title": "SCIM source (inbound provisioning)",
            "url": "https://docs.goauthentik.io/users-sources/sources/protocols/scim"
          }
        ]
      },
      "quickstart": {
        "framework": "Docker Compose (server)",
        "url": "https://docs.goauthentik.io/install-config/install/docker-compose",
        "steps": 7,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "authentik installs locally with Docker Compose; the open-source edition is free and an Enterprise edition is paid.",
        "sources": [
          {
            "title": "Docker Compose installation",
            "url": "https://docs.goauthentik.io/install-config/install/docker-compose"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://github.com/goauthentik/authentik/blob/main/schema.yml",
        "webhooks": "yes",
        "rate_limits_url": null,
        "status_page_url": null,
        "changelog_url": "https://github.com/goauthentik/authentik/releases",
        "changelog_last_entry": "2026-10-21",
        "sources": [
          {
            "title": "OpenAPI schema (schema.yml)",
            "url": "https://github.com/goauthentik/authentik/blob/main/schema.yml"
          },
          {
            "title": "Notification transports (webhook)",
            "url": "https://docs.goauthentik.io/sys-mgmt/events/transports"
          }
        ]
      },
      "ai": {
        "mcp_server": "unknown",
        "mcp_server_url": null,
        "agent_auth_docs": "unknown",
        "m2m_tokens": "yes",
        "token_exchange": "yes",
        "mcp_authorization": "unknown",
        "llms_txt_url": "https://docs.goauthentik.io/llms.txt",
        "sources": [
          {
            "title": "Machine-to-machine (M2M) authentication",
            "url": "https://docs.goauthentik.io/add-secure-apps/providers/oauth2/machine_to_machine"
          },
          {
            "title": "Token exchange",
            "url": "https://docs.goauthentik.io/add-secure-apps/providers/oauth2/token_exchange"
          }
        ]
      },
      "open_source": {
        "self_host": "yes",
        "license": null,
        "repo_url": "https://github.com/goauthentik/authentik"
      },
      "ecosystem": {
        "github_repo": "goauthentik/authentik",
        "github_stars": 26245,
        "npm_package": "@goauthentik/api",
        "npm_weekly_downloads": 8723,
        "measured_on": "2026-11-05"
      },
      "notes": "authentik is a self-hosted identity provider built on configurable flows and stages; login and passkey enrollment are server-rendered flow pages, with no embeddable components or framework SDKs (only generated API clients). The GitHub API reports the license as NOASSERTION because the repository mixes an open-source core with a separately licensed enterprise directory, so no license is scored. Upstream SAML and OAuth sources are configured by administrators, which the rubric counts as partial enterprise SSO.",
      "score": 61,
      "score_breakdown": {
        "sdks": 3,
        "ui": 6,
        "methods": 14,
        "quickstart": 4,
        "local_dev": 10,
        "api": 15,
        "ai": 6,
        "open_source": 3
      },
      "changelog_fresh": true
    },
    {
      "key": "open-source/hanko",
      "name": "Hanko",
      "kind": "open-source",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [],
        "frontend": [],
        "sources": [
          {
            "title": "Hanko quickstarts overview",
            "url": "https://docs.hanko.io/quickstarts/overview"
          },
          {
            "title": "Using the Hanko frontend SDK",
            "url": "https://docs.hanko.io/guides/hanko-elements/using-frontend-sdk"
          }
        ]
      },
      "ui": {
        "hosted_login": "unknown",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Integrate Hanko with Next.js (hanko-auth and hanko-profile elements)",
            "url": "https://docs.hanko.io/quickstarts/fullstack/next"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "partial",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "unknown",
        "sources": [
          {
            "title": "Social SSO",
            "url": "https://docs.hanko.io/guides/social-sso/introduction"
          },
          {
            "title": "Using SAML SSO with Hanko",
            "url": "https://docs.hanko.io/guides/enterprise-sso/introduction"
          },
          {
            "title": "Hanko pricing",
            "url": "https://www.hanko.io/pricing"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://docs.hanko.io/quickstarts/fullstack/next",
        "steps": 9,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Hanko is open source and self-hostable (the repository ships a quickstart and deploy configurations), and Hanko Cloud has a free plan with 10,000 MAU.",
        "sources": [
          {
            "title": "Hanko repository",
            "url": "https://github.com/teamhanko/hanko"
          },
          {
            "title": "Hanko pricing",
            "url": "https://www.hanko.io/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://github.com/teamhanko/docs/blob/main/openapi-admin.yaml",
        "webhooks": "yes",
        "rate_limits_url": null,
        "status_page_url": "https://status.hanko.io",
        "changelog_url": "https://github.com/teamhanko/hanko/releases",
        "changelog_last_entry": "2026-10-01",
        "sources": [
          {
            "title": "Using Hanko webhooks",
            "url": "https://docs.hanko.io/guides/webhooks"
          },
          {
            "title": "Admin API OpenAPI spec",
            "url": "https://github.com/teamhanko/docs/blob/main/openapi-admin.yaml"
          }
        ]
      },
      "ai": {
        "mcp_server": "unknown",
        "mcp_server_url": null,
        "agent_auth_docs": "unknown",
        "m2m_tokens": "unknown",
        "token_exchange": "unknown",
        "mcp_authorization": "unknown",
        "llms_txt_url": "https://docs.hanko.io/llms.txt",
        "sources": []
      },
      "open_source": {
        "self_host": "yes",
        "license": "AGPL-3.0",
        "repo_url": "https://github.com/teamhanko/hanko"
      },
      "ecosystem": {
        "github_repo": "teamhanko/hanko",
        "github_stars": 9066,
        "npm_package": "@teamhanko/hanko-elements",
        "npm_weekly_downloads": 16777,
        "measured_on": "2026-11-05"
      },
      "notes": "Hanko Elements are framework-neutral web components (hanko-auth, hanko-profile) used from React, Vue, Angular, Svelte and others, so no framework SDK is counted, and the backend quickstarts verify Hanko JWTs with standard libraries rather than an official server SDK. Email sign-in uses one-time passcodes rather than links. SAML SSO is a paid add-on at $49 a month per connection on Hanko Cloud; the docs token-exchange endpoint is part of Hanko's own flow API, not RFC 8693.",
      "score": 56,
      "score_breakdown": {
        "sdks": 0,
        "ui": 7,
        "methods": 12,
        "quickstart": 3,
        "local_dev": 10,
        "api": 17,
        "ai": 2,
        "open_source": 5
      },
      "changelog_fresh": true
    },
    {
      "key": "open-source/keycloak",
      "name": "Keycloak",
      "kind": "open-source",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "java",
          "node"
        ],
        "frontend": [],
        "sources": [
          {
            "title": "Securing applications and services (client adapters)",
            "url": "https://www.keycloak.org/securing-apps/overview"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "no",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Server administration guide (themes, account console, passkeys)",
            "url": "https://www.keycloak.org/docs/latest/server_admin/index.html"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "unknown",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "yes",
        "sources": [
          {
            "title": "Server administration guide (passkeys, identity brokering, SCIM)",
            "url": "https://www.keycloak.org/docs/latest/server_admin/index.html"
          }
        ]
      },
      "quickstart": {
        "framework": "Docker (server)",
        "url": "https://www.keycloak.org/getting-started/getting-started-docker",
        "steps": 6,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Keycloak runs locally in development mode from a single docker run command; the project is free and open source.",
        "sources": [
          {
            "title": "Get started with Keycloak on Docker",
            "url": "https://www.keycloak.org/getting-started/getting-started-docker"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://www.keycloak.org/docs-api/latest/rest-api/openapi.json",
        "webhooks": "unknown",
        "rate_limits_url": null,
        "status_page_url": null,
        "changelog_url": "https://github.com/keycloak/keycloak/releases",
        "changelog_last_entry": "2026-11-05",
        "sources": [
          {
            "title": "Admin REST API OpenAPI document",
            "url": "https://www.keycloak.org/docs-api/latest/rest-api/openapi.json"
          },
          {
            "title": "Release notes",
            "url": "https://www.keycloak.org/docs/latest/release_notes/index.html"
          }
        ]
      },
      "ai": {
        "mcp_server": "unknown",
        "mcp_server_url": null,
        "agent_auth_docs": "unknown",
        "m2m_tokens": "yes",
        "token_exchange": "yes",
        "mcp_authorization": "unknown",
        "llms_txt_url": null,
        "sources": [
          {
            "title": "Token exchange",
            "url": "https://www.keycloak.org/securing-apps/token-exchange"
          },
          {
            "title": "Server administration guide (service accounts)",
            "url": "https://www.keycloak.org/docs/latest/server_admin/index.html"
          }
        ]
      },
      "open_source": {
        "self_host": "yes",
        "license": "Apache-2.0",
        "repo_url": "https://github.com/keycloak/keycloak"
      },
      "ecosystem": {
        "github_repo": "keycloak/keycloak",
        "github_stars": 37720,
        "npm_package": "keycloak-js",
        "npm_weekly_downloads": 1495030,
        "measured_on": "2026-11-05"
      },
      "notes": "Keycloak is a self-hosted server with no vendor-run cloud, so rate limits and a status page do not apply. Login, registration and passkey registration are server-rendered themes; there are no embeddable components, and the JavaScript adapter is framework-neutral. SAML and OIDC identity brokering and Organizations are configured by realm administrators rather than through a customer self-service portal.",
      "score": 56,
      "score_breakdown": {
        "sdks": 2,
        "ui": 6,
        "methods": 14,
        "quickstart": 4,
        "local_dev": 10,
        "api": 11,
        "ai": 4,
        "open_source": 5
      },
      "changelog_fresh": true
    },
    {
      "key": "ciam/google-identity",
      "name": "Firebase Authentication / Identity Platform",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "java",
          "python",
          "go",
          "dotnet"
        ],
        "frontend": [
          "angular",
          "ios",
          "android",
          "flutter"
        ],
        "sources": [
          {
            "title": "Add the Firebase Admin SDK to your server",
            "url": "https://firebase.google.com/docs/admin/setup"
          },
          {
            "title": "AngularFire",
            "url": "https://github.com/firebase/angularfire"
          }
        ]
      },
      "ui": {
        "hosted_login": "unknown",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "unknown",
        "sources": [
          {
            "title": "FirebaseUI for web",
            "url": "https://firebase.google.com/docs/auth/web/firebaseui"
          }
        ]
      },
      "methods": {
        "passkeys": "unknown",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "unknown",
        "sources": [
          {
            "title": "Email link authentication",
            "url": "https://firebase.google.com/docs/auth/web/email-link-auth"
          },
          {
            "title": "Identity Platform: SAML sign-in",
            "url": "https://cloud.google.com/identity-platform/docs/web/saml"
          },
          {
            "title": "Identity Platform: OIDC sign-in",
            "url": "https://cloud.google.com/identity-platform/docs/web/oidc"
          }
        ]
      },
      "quickstart": {
        "framework": "Web (JavaScript)",
        "url": "https://firebase.google.com/docs/auth/web/start",
        "steps": 5,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "The Firebase Local Emulator Suite includes an Authentication emulator with a UI and REST API for testing.",
        "sources": [
          {
            "title": "Connect your app to the Authentication Emulator",
            "url": "https://firebase.google.com/docs/emulator-suite/connect_auth"
          },
          {
            "title": "Firebase pricing",
            "url": "https://firebase.google.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": null,
        "webhooks": "partial",
        "rate_limits_url": "https://firebase.google.com/docs/auth/limits",
        "status_page_url": "https://status.firebase.google.com",
        "changelog_url": "https://cloud.google.com/identity-platform/docs/release-notes",
        "changelog_last_entry": "2024-12-03",
        "sources": [
          {
            "title": "Extend Firebase Authentication with blocking functions",
            "url": "https://firebase.google.com/docs/auth/extend-with-blocking-functions"
          },
          {
            "title": "Firebase Authentication limits",
            "url": "https://firebase.google.com/docs/auth/limits"
          },
          {
            "title": "Identity Platform release notes",
            "url": "https://cloud.google.com/identity-platform/docs/release-notes"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://firebase.google.com/docs/ai-assistance/mcp-server",
        "agent_auth_docs": "unknown",
        "m2m_tokens": "unknown",
        "token_exchange": "unknown",
        "mcp_authorization": "unknown",
        "llms_txt_url": "https://firebase.google.com/docs/llms.txt",
        "sources": [
          {
            "title": "Firebase MCP server (manage Authentication users)",
            "url": "https://firebase.google.com/docs/ai-assistance/mcp-server"
          }
        ]
      },
      "open_source": {
        "self_host": "no",
        "license": null,
        "repo_url": "https://github.com/firebase/firebase-js-sdk"
      },
      "ecosystem": {
        "github_repo": "firebase/firebase-js-sdk",
        "github_stars": 5158,
        "npm_package": "firebase",
        "npm_weekly_downloads": 13926841,
        "measured_on": "2026-11-05"
      },
      "notes": "SAML and OIDC providers and multi-tenancy need the Identity Platform upgrade and are configured by the developer, so enterprise SSO is partial. The Firebase Authentication docs index does not mention passkeys or WebAuthn. The primary web quickstart is plain JavaScript (no official React or Next.js SDK), and the npm figure covers the whole Firebase JS SDK, not Authentication alone.",
      "score": 55,
      "score_breakdown": {
        "sdks": 9,
        "ui": 4,
        "methods": 10,
        "quickstart": 5,
        "local_dev": 10,
        "api": 11,
        "ai": 6,
        "open_source": 0
      },
      "changelog_fresh": false
    },
    {
      "key": "ciam/microsoft-entra-external-id",
      "name": "Microsoft Entra External ID",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "python",
          "java",
          "dotnet",
          "go"
        ],
        "frontend": [
          "react",
          "angular",
          "ios",
          "android"
        ],
        "sources": [
          {
            "title": "Microsoft Authentication Library (MSAL) overview",
            "url": "https://learn.microsoft.com/en-us/entra/identity-platform/msal-overview"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "unknown",
        "passkey_enrollment_ui": "unknown",
        "sources": [
          {
            "title": "Authentication methods and identity providers for customers",
            "url": "https://learn.microsoft.com/en-us/entra/external-id/customers/concept-authentication-methods-customers"
          },
          {
            "title": "Native authentication (API-based, your own UI)",
            "url": "https://learn.microsoft.com/en-us/entra/external-id/customers/concept-native-authentication"
          }
        ]
      },
      "methods": {
        "passkeys": "unknown",
        "magic_link": "partial",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "unknown",
        "sources": [
          {
            "title": "Authentication methods and identity providers for customers",
            "url": "https://learn.microsoft.com/en-us/entra/external-id/customers/concept-authentication-methods-customers"
          }
        ]
      },
      "quickstart": {
        "framework": "Node.js (Express sample)",
        "url": "https://learn.microsoft.com/en-us/entra/external-id/customers/sample-web-app-node-sign-in",
        "steps": 3,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "unknown",
        "free_tier": "yes",
        "note": "External tenants are cloud-only; Microsoft documents no local emulator or dedicated development mode, and the VS Code extension can create an external tenant.",
        "sources": [
          {
            "title": "External ID pricing",
            "url": "https://learn.microsoft.com/en-us/entra/external-id/external-identities-pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://github.com/microsoftgraph/msgraph-metadata",
        "webhooks": "yes",
        "rate_limits_url": "https://learn.microsoft.com/en-us/graph/throttling",
        "status_page_url": "https://azure.status.microsoft/en-us/status",
        "changelog_url": "https://learn.microsoft.com/en-us/entra/external-id/customers/whats-new-docs",
        "changelog_last_entry": "2026-01",
        "sources": [
          {
            "title": "Microsoft Graph change notifications",
            "url": "https://learn.microsoft.com/en-us/graph/change-notifications-overview"
          },
          {
            "title": "Microsoft Graph throttling",
            "url": "https://learn.microsoft.com/en-us/graph/throttling"
          },
          {
            "title": "What's new in External ID docs",
            "url": "https://learn.microsoft.com/en-us/entra/external-id/customers/whats-new-docs"
          }
        ]
      },
      "ai": {
        "mcp_server": "yes",
        "mcp_server_url": "https://learn.microsoft.com/en-us/graph/mcp-server/overview",
        "agent_auth_docs": "unknown",
        "m2m_tokens": "yes",
        "token_exchange": "unknown",
        "mcp_authorization": "unknown",
        "llms_txt_url": null,
        "sources": [
          {
            "title": "Microsoft MCP Server for Enterprise (Microsoft Graph)",
            "url": "https://learn.microsoft.com/en-us/graph/mcp-server/overview"
          },
          {
            "title": "MSAL overview (client credentials)",
            "url": "https://learn.microsoft.com/en-us/entra/identity-platform/msal-overview"
          }
        ]
      },
      "open_source": {
        "self_host": "no",
        "license": null,
        "repo_url": "https://github.com/AzureAD/microsoft-authentication-library-for-js"
      },
      "ecosystem": {
        "github_repo": "AzureAD/microsoft-authentication-library-for-js",
        "github_stars": 4152,
        "npm_package": "@azure/msal-browser",
        "npm_weekly_downloads": 27763650,
        "measured_on": "2026-11-05"
      },
      "notes": "Customers sign up with email and password or an email one-time passcode (no magic link), social providers, or custom OIDC and SAML/WS-Fed providers that the developer configures, so magic link and enterprise SSO are partial. The authentication methods page for external tenants does not list passkeys. MSAL libraries and the npm figure are shared with workforce Entra ID, and the docs what's-new page was last updated for January 2026. The MCP server counted is Microsoft's MCP Server for Enterprise, which queries Microsoft Graph tenant data rather than a CIAM-specific server.",
      "score": 53,
      "score_breakdown": {
        "sdks": 9,
        "ui": 3,
        "methods": 8,
        "quickstart": 5,
        "local_dev": 5,
        "api": 17,
        "ai": 6,
        "open_source": 0
      },
      "changelog_fresh": false
    },
    {
      "key": "ciam/mojoauth",
      "name": "MojoAuth",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node",
          "go",
          "java",
          "dotnet",
          "php"
        ],
        "frontend": [
          "ios",
          "android"
        ],
        "sources": [
          {
            "title": "MojoAuth docs index (SDK pages)",
            "url": "https://mojoauth.com/docs/llms.txt"
          },
          {
            "title": "MojoAuth GitHub organization",
            "url": "https://github.com/mojoauth"
          }
        ]
      },
      "ui": {
        "hosted_login": "yes",
        "embeddable_components": "unknown",
        "passkey_enrollment_ui": "unknown",
        "sources": [
          {
            "title": "Hosted login page (OIDC guide)",
            "url": "https://mojoauth.com/docs/hosted-login-page/"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "unknown",
        "sources": [
          {
            "title": "Passkeys",
            "url": "https://mojoauth.com/docs/authentication/integrate-passkeys/"
          },
          {
            "title": "Social login",
            "url": "https://mojoauth.com/docs/authentication/social-login/"
          },
          {
            "title": "SSO connections overview",
            "url": "https://mojoauth.com/docs/sso-integrations/overview/"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js (NextAuth.js with hosted login)",
        "url": "https://mojoauth.com/docs/fullstack/nextjs/",
        "steps": 12,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "unknown",
        "free_tier": "yes",
        "note": "The docs we read describe no dedicated development or test environment; the Free plan covers up to 25,000 MAUs.",
        "sources": [
          {
            "title": "MojoAuth pricing",
            "url": "https://mojoauth.com/pricing"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": null,
        "webhooks": "yes",
        "rate_limits_url": null,
        "status_page_url": "https://status.mojoauth.com",
        "changelog_url": null,
        "changelog_last_entry": null,
        "sources": [
          {
            "title": "API reference",
            "url": "https://mojoauth.com/docs/api-reference/"
          },
          {
            "title": "Webhooks",
            "url": "https://mojoauth.com/docs/webhooks/"
          }
        ]
      },
      "ai": {
        "mcp_server": "unknown",
        "mcp_server_url": null,
        "agent_auth_docs": "unknown",
        "m2m_tokens": "unknown",
        "token_exchange": "unknown",
        "mcp_authorization": "unknown",
        "llms_txt_url": "https://mojoauth.com/docs/llms.txt",
        "sources": []
      },
      "open_source": {
        "self_host": "partial",
        "license": null,
        "repo_url": "https://github.com/mojoauth/node-sdk"
      },
      "ecosystem": {
        "github_repo": "mojoauth/node-sdk",
        "github_stars": 1,
        "npm_package": "mojoauth-sdk",
        "npm_weekly_downloads": 37,
        "measured_on": "2026-11-05"
      },
      "notes": "MojoAuth focuses on passwordless sign-in (passkeys, email magic links and OTP, SMS OTP, social and Google One Tap) through a hosted login page; the Free plan covers up to 25,000 MAUs. The Next.js guide connects to the hosted page with NextAuth.js over OIDC rather than a MojoAuth Next.js SDK. Enterprise SSO is SAML connections set up by the developer per provider guide; self-hosting is described only as private-cloud deployment options in the docs.",
      "score": 45.5,
      "score_breakdown": {
        "sdks": 7,
        "ui": 3,
        "methods": 14,
        "quickstart": 3,
        "local_dev": 5,
        "api": 10,
        "ai": 2,
        "open_source": 1.5
      },
      "changelog_fresh": false
    },
    {
      "key": "open-source/authjs",
      "name": "Auth.js (NextAuth.js)",
      "kind": "library",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "node"
        ],
        "frontend": [
          "nextjs",
          "svelte"
        ],
        "sources": [
          {
            "title": "Auth.js reference: Next.js",
            "url": "https://authjs.dev/reference/nextjs"
          },
          {
            "title": "Auth.js reference: SvelteKit",
            "url": "https://authjs.dev/reference/sveltekit"
          },
          {
            "title": "Auth.js reference: Express",
            "url": "https://authjs.dev/reference/express"
          }
        ]
      },
      "ui": {
        "hosted_login": "partial",
        "embeddable_components": "no",
        "passkey_enrollment_ui": "partial",
        "sources": [
          {
            "title": "Built-in pages",
            "url": "https://authjs.dev/guides/pages/built-in-pages"
          },
          {
            "title": "WebAuthn (passkeys)",
            "url": "https://authjs.dev/getting-started/authentication/webauthn"
          }
        ]
      },
      "methods": {
        "passkeys": "partial",
        "magic_link": "yes",
        "social_login": "yes",
        "enterprise_sso": "partial",
        "scim": "unknown",
        "sources": [
          {
            "title": "WebAuthn (passkeys, experimental)",
            "url": "https://authjs.dev/getting-started/authentication/webauthn"
          },
          {
            "title": "Email (magic links)",
            "url": "https://authjs.dev/getting-started/authentication/email"
          },
          {
            "title": "OAuth providers",
            "url": "https://authjs.dev/getting-started/authentication/oauth"
          },
          {
            "title": "BoxyHQ SAML provider",
            "url": "https://authjs.dev/getting-started/providers/boxyhq-saml"
          }
        ]
      },
      "quickstart": {
        "framework": "Next.js",
        "url": "https://authjs.dev/getting-started/installation",
        "steps": 4,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "yes",
        "free_tier": "yes",
        "note": "Auth.js is an open-source library that runs inside your app, so it works locally with no external service.",
        "sources": [
          {
            "title": "Installation",
            "url": "https://authjs.dev/getting-started/installation"
          }
        ]
      },
      "api": {
        "management_api": "no",
        "openapi_url": null,
        "webhooks": "unknown",
        "rate_limits_url": null,
        "status_page_url": null,
        "changelog_url": "https://github.com/nextauthjs/next-auth/releases",
        "changelog_last_entry": "2026-07-20",
        "sources": [
          {
            "title": "next-auth releases",
            "url": "https://github.com/nextauthjs/next-auth/releases"
          }
        ]
      },
      "ai": {
        "mcp_server": "unknown",
        "mcp_server_url": null,
        "agent_auth_docs": "unknown",
        "m2m_tokens": "unknown",
        "token_exchange": "unknown",
        "mcp_authorization": "unknown",
        "llms_txt_url": null,
        "sources": []
      },
      "open_source": {
        "self_host": "yes",
        "license": "ISC",
        "repo_url": "https://github.com/nextauthjs/next-auth"
      },
      "ecosystem": {
        "github_repo": "nextauthjs/next-auth",
        "github_stars": 28374,
        "npm_package": "next-auth",
        "npm_weekly_downloads": 9195783,
        "measured_on": "2026-11-05"
      },
      "notes": "The project README says \"Auth js is now part of Better Auth\" and recommends that new projects start with Better Auth, and the docs include a migration guide. The WebAuthn (passkeys) provider is labelled experimental and not recommended for production, so passkeys and the built-in passkey registration page score partial. Auth.js is a library with no user-management API; its built-in sign-in pages are basic and usually replaced with custom pages.",
      "score": 38,
      "score_breakdown": {
        "sdks": 3,
        "ui": 3,
        "methods": 12,
        "quickstart": 5,
        "local_dev": 10,
        "api": 0,
        "ai": 0,
        "open_source": 5
      },
      "changelog_fresh": false
    },
    {
      "key": "ciam/corbado",
      "name": "Corbado (Connect and Observe)",
      "kind": "managed",
      "checked_on": "2026-11-05",
      "sdks": {
        "server": [
          "python"
        ],
        "frontend": [
          "ios",
          "android",
          "flutter"
        ],
        "sources": [
          {
            "title": "Corbado GitHub organization",
            "url": "https://github.com/corbado"
          },
          {
            "title": "Web UI components",
            "url": "https://docs.corbado.com/corbado-connect/web-ui-components/overview"
          }
        ]
      },
      "ui": {
        "hosted_login": "no",
        "embeddable_components": "yes",
        "passkey_enrollment_ui": "yes",
        "sources": [
          {
            "title": "Web UI components for passkey integration",
            "url": "https://docs.corbado.com/corbado-connect/web-ui-components/overview"
          },
          {
            "title": "CorbadoConnectAppend: add passkeys to accounts",
            "url": "https://docs.corbado.com/corbado-connect/web-ui-components/corbadoconnectappend"
          }
        ]
      },
      "methods": {
        "passkeys": "yes",
        "magic_link": "unknown",
        "social_login": "unknown",
        "enterprise_sso": "unknown",
        "scim": "unknown",
        "sources": [
          {
            "title": "Corbado Connect: enterprise passkey integration",
            "url": "https://docs.corbado.com/corbado-connect/overview/welcome"
          }
        ]
      },
      "quickstart": {
        "framework": "Demo and source code (generic IdP)",
        "url": "https://docs.corbado.com/corbado-connect/overview/getting-started",
        "steps": 3,
        "time_claim": null
      },
      "local_dev": {
        "dev_environment": "unknown",
        "free_tier": "unknown",
        "note": "Corbado Connect is deployed per customer on a shared or dedicated AWS instance; the docs we read describe no self-serve development tier.",
        "sources": [
          {
            "title": "Deploying Corbado Connect",
            "url": "https://docs.corbado.com/corbado-connect/architecture/deployment"
          }
        ]
      },
      "api": {
        "management_api": "yes",
        "openapi_url": "https://docs.corbado.com/api-reference/openapi/connect-backend.yaml",
        "webhooks": "partial",
        "rate_limits_url": null,
        "status_page_url": null,
        "changelog_url": null,
        "changelog_last_entry": null,
        "sources": [
          {
            "title": "Connect API authentication",
            "url": "https://docs.corbado.com/api-reference/connect/authentication"
          },
          {
            "title": "Actions in Corbado Connect",
            "url": "https://docs.corbado.com/corbado-connect/architecture/actions"
          }
        ]
      },
      "ai": {
        "mcp_server": "partial",
        "mcp_server_url": "https://docs.corbado.com/corbado-observe/tools/mcp-server",
        "agent_auth_docs": "unknown",
        "m2m_tokens": "unknown",
        "token_exchange": "unknown",
        "mcp_authorization": "unknown",
        "llms_txt_url": "https://docs.corbado.com/llms.txt",
        "sources": [
          {
            "title": "Corbado Observe MCP server (closed beta)",
            "url": "https://docs.corbado.com/corbado-observe/tools/mcp-server"
          }
        ]
      },
      "open_source": {
        "self_host": "partial",
        "license": null,
        "repo_url": "https://github.com/corbado/corbado-ios"
      },
      "ecosystem": {
        "github_repo": "corbado/corbado-ios",
        "github_stars": 4,
        "npm_package": null,
        "npm_weekly_downloads": null,
        "measured_on": "2026-11-05"
      },
      "notes": "Corbado now sells Connect, a passkey layer added on top of an existing identity provider (for example Amazon Cognito), and Observe, authentication analytics, rather than a full login platform, so password, magic link, social and enterprise SSO stay with your existing IdP and are recorded as not documented. Connect runs on a shared or dedicated AWS instance (private cloud partial). The Observe MCP server is in closed beta for enterprise customers, which scores partial.",
      "score": 35.5,
      "score_breakdown": {
        "sdks": 4,
        "ui": 7,
        "methods": 4,
        "quickstart": 5,
        "local_dev": 0,
        "api": 10,
        "ai": 4,
        "open_source": 1.5
      },
      "changelog_fresh": false
    }
  ]
}