The State of API Authentication

About this paper

This market publishes better than any other area scored in this series, and it is missing exactly one thing — the thing it sells.

Forty identity, authentication and authorization providers, measured on the same rubric applied to Stripe. The results are the strongest in the series: composite 50.4 against a whole-catalog average of 22.8, agent readiness 36.3 against 12.7, seven Exemplars where the catalog rate is 1.3%, and nothing at all below the Thin band.

97.5% publish a machine-readable contract. Thirty-nine of forty. In the documentation market that figure was 51.7%; in testing 45.9%; among API clients it was three of thirty-five. This market publishes because its product is an API — an identity provider that cannot be called is not a product — and it shows in every facet the rubric reads. Contract quality at 61.8 is the highest any cohort here has recorded.

It is also the one market with a genuinely shared resource model: users across twenty providers, roles thirteen, organizations eleven, applications ten. OAuth, OpenID Connect and SCIM standardized these nouns decades ago, and the convergence is what makes identity products substitutable.

Six vendors run a public MCP server — the most of any area cohort, against zero in management, documentation and SDK generation combined — and PropelAuth publishes an OAuth 2.1 authorization server built for MCP, with live /authorize, /token and /introspect endpoints. That is the most forward artifact this research has found in any market.

And then the finding this report is really about.

Delegated identity and consent signal appears once in forty. 2.5%.

That dimension asks whether an agent can act on a principal’s behalf with authority that is scoped, attributable and revocable. It is a description of what every company in this study sells. These are the vendors whose entire product is letting one party act for another under controlled conditions — and who in large part wrote OAuth and OpenID Connect to do it. They have built that for human-facing applications about as well as it has ever been built. They have very largely not re-described it for a machine principal acting continuously without a browser.

Underneath it sits a second irony: governance is the weakest facet at 31.1, with eighteen of forty at zero, in the market that sells access governance.

Every market in this series is being asked to become legible to agents. This one is being asked something harder: to decide what an agent is allowed to be. The full report maps the five-tier structure, the standards layer this market authored rather than adopted, the regulatory layer where a mandate created a market, and the investable thesis on why the single number that matters most here is a 1 out of 40.

What's inside

1. Executive summary — the market that sells delegated authority
2. The state of the market — five tiers and the wave the index missed
3. The resource taxonomy — the one market with a shared model
4. The composite Kin Score — the strongest cohort, and a governance problem
5. Agent readiness — six MCP servers and one missing primitive
6. The blueprint — what the leaders satisfy, and what nobody does
7. Provenance — a score with two authors
8. The standards layer — the market that wrote the specifications
9. The regulatory layer — where a mandate created a market
10. Artifacts for the agentic turn — the market best placed to solve agent identity
11. Security, scopes and disclosure
12. Provider-by-provider intelligence
13. The investable thesis
14. Where this is going

What you get for $500.00