{"jtbd":{"id":"agent-m2m-identity","slug":"agent-m2m-identity","name":"Machine-to-machine agent identity","shortName":"Agent M2M identity","problemStatement":"Issue non-human identities, mTLS/JWT, and scoped tokens so agents authenticate to APIs without sharing user sessions."},"pick":{"id":"stytch","slug":"stytch","name":"Stytch","tagline":"Auth pick when agents/M2M + org SSO matter more than Clerk's consumer UI kit. Watch Twilio integration…","website":"https://stytch.com","overall":8.21,"scoreBand":{"low":7.6,"mid":8.2,"high":8.8,"halfWidth":0.6,"basis":"editorial_prior","display":"7.6–8.8 (editorial prior)"},"scoreLayers":{"editorialPrior":8.21,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","pricingNotes":"As of 2026-09-14 (stytch.com/pricing B2B): Pay as you go $0 base — 10,000 MAU/agents included, unlimited orgs, 5 SSO/SCIM connections ($125/extra), 1,000 M2M tokens, 10k fingerprints then $0.005 each; brand customization $99/mo. Enterprise quote (99.99% SLA, HIPAA/BAA). Note: Stytch joined Twilio (identity layer) — product/brand still live.","scores":{"capabilityFit":8.6,"pricePerformance":8.8,"latencyReliability":8.4,"developerDx":8.8,"privacyPosture":8.2,"lockInRisk":4.2,"maturity":8,"overall":8.21,"kind":"curated_estimate","confidence":"high","asOf":"2026-09-14"}},"runnersUp":[{"id":"workos","slug":"workos","name":"WorkOS","tagline":"When your first big customer asks for Okta SSO tomorrow, WorkOS is how you say yes without a rewrite.","website":"https://workos.com","overall":8.54,"scoreBand":{"low":7.9,"mid":8.5,"high":9.1,"halfWidth":0.6,"basis":"editorial_prior","display":"7.9–9.1 (editorial prior)"},"scoreLayers":{"editorialPrior":8.54,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","pricingNotes":"Enterprise SSO/Directory Sync/Audit Log APIs; per-connection and MAU-style packaging.","scores":{"capabilityFit":9.2,"pricePerformance":7.5,"latencyReliability":9,"developerDx":9.4,"privacyPosture":8.8,"lockInRisk":4.5,"maturity":8.5,"overall":8.54,"kind":"curated_estimate","confidence":"high","asOf":"2026-09-14"}},{"id":"auth0","slug":"auth0","name":"Auth0 (Okta)","tagline":"Enterprise identity Swiss Army knife. For startups, Clerk/WorkOS usually hurt less.","website":"https://auth0.com","overall":8.08,"scoreBand":{"low":7.5,"mid":8.1,"high":8.7,"halfWidth":0.6,"basis":"editorial_prior","display":"7.5–8.7 (editorial prior)"},"scoreLayers":{"editorialPrior":8.08,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","pricingNotes":"MAU and enterprise contracts; extensive IdP ecosystem; Okta-owned.","scores":{"capabilityFit":9.2,"pricePerformance":5.5,"latencyReliability":9.2,"developerDx":7.5,"privacyPosture":8.8,"lockInRisk":7,"maturity":9.6,"overall":8.08,"kind":"curated_estimate","confidence":"high","asOf":"2026-09-14"}},{"id":"clerk","slug":"clerk","name":"Clerk","tagline":"Depot default auth for agent products with users. WorkOS when enterprise SSO is the main job.","website":"https://clerk.com","overall":8.25,"scoreBand":{"low":7.7,"mid":8.3,"high":8.9,"halfWidth":0.6,"basis":"editorial_prior","display":"7.7–8.9 (editorial prior)"},"scoreLayers":{"editorialPrior":8.25,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-10-19","pricingNotes":"Bills monthly retained users (MRU: a user who returns at least one day after signing up), not MAU (https://clerk.com/pricing, fetched 2026-10-21): Hobby free up to 50,000 MRU per app; Pro $25/mo and Business $300/mo include 50,000 MRU per app, then graduated $0.02 / $0.018 / $0.015 / $0.012 per MRU; 1 SSO connection included on paid plans, then $75 / $60 each (101+ contact us). B2B Authentication add-on $100/mo; beautiful prebuilt UIs.","scores":{"capabilityFit":9,"pricePerformance":8,"latencyReliability":9,"developerDx":9.8,"privacyPosture":8.2,"lockInRisk":6.5,"maturity":8.5,"overall":8.25,"kind":"curated_estimate","confidence":"high","asOf":"2026-10-19"}},{"id":"infisical","slug":"infisical","name":"Infisical","tagline":"Depot default for agent secrets when you want OSS exit + Agent Proxy (placeholders instead of raw keys in the…","website":"https://infisical.com","overall":8.44,"scoreBand":{"low":7.8,"mid":8.4,"high":9,"halfWidth":0.6,"basis":"editorial_prior","display":"7.8–9.0 (editorial prior)"},"scoreLayers":{"editorialPrior":8.44,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","pricingNotes":"As of 2026-09-14: Secrets billed per identity (human+machine). Free: 5 identities + MIT self-host core. Pro ~$20/identity/mo annual ($23 monthly); Advanced ~$40/$46 with dynamic secrets + Agent Proxy for dynamic secrets; Enterprise custom. Agent Proxy for static secrets on all plans including Free.","scores":{"capabilityFit":8.8,"pricePerformance":8.2,"latencyReliability":8.2,"developerDx":8.8,"privacyPosture":9,"lockInRisk":3.5,"maturity":7.8,"overall":8.44,"kind":"curated_estimate","confidence":"high","asOf":"2026-09-14"}}],"scoreBand":{"low":7.6,"mid":8.2,"high":8.8,"halfWidth":0.6,"basis":"editorial_prior","display":"7.6–8.8 (editorial prior)"},"scoreLayers":{"editorialPrior":8.21,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"whyPickOverHigherScore":{"pickId":"stytch","pickName":"Stytch","pickScore":8.21,"highestScoredCandidateId":"workos","highestScoredCandidateName":"WorkOS","highestScore":8.54,"pickHasLowerCompositeScore":true,"delta":-0.33,"pickLeadsOnDimensions":["pricePerformance (8.8 vs 7.5)","lower lockInRisk (4.2 vs 4.5)"],"explanation":"Stytch (8.21) is the editorial pick for Machine-to-machine agent identity over higher-composite WorkOS (8.54) because composite scores are provider-wide priors while Stytch wins on pricePerformance (8.8 vs 7.5), lower lockInRisk (4.2 vs 4.5): Auth category; privacy + maturity. Not a full W3C DID network — pragmatic M2M. Confidence: medium-high."},"cheapest":null,"recommendedWorkloadQuote":null,"representativeQuote":null,"estimatedTaskCost":null,"freeAlternatives":[],"referenceDocs":[],"falsification":{"jtbdId":"agent-m2m-identity","jtbdName":"Machine-to-machine agent identity","currentPickId":"stytch","currentPickScore":8.21,"challengerId":"workos","challengerScore":8.54,"currentScoreGap":0.33,"minVerifiedOutcomes":10,"requiredOutcomeMargin":0.48,"requiredSuccessRateDelta":0.15,"maxPickPriceIncreasePct":25,"whatWouldChangePick":["WorkOS (workos) outperforms Stytch (stytch) by >= 0.48 outcome points (or >= 15% worked-rate delta) across >= 10 Countersign-verified production outcomes.","A verified price increase > 25% on Stytch's representative SKU for agent-m2m-identity without a corresponding capability gain.","Live caller rail exhaustion (?exhausted=stytch) or sustained >= 30% degraded/failed rate in verified production outcomes."],"frozenHoldoutPolicy":{"holdoutSplit":"20% frozen benchmark holdout tasks + 80% live production outcome receipts","requireCountersignReceipt":true,"requiredEvidenceTiers":["outcome_verified","reference_checked"],"minDistinctContributors":2,"antiGamingRule":"Unverified self-reports and seed/editorial rows never mutate picks or scores."},"triggers":[{"kind":"verified_outcomes_outperformance","challengerId":"workos","minVerifiedOutcomes":10,"requiredOutcomeMargin":0.48,"requiredWorkedRateDelta":0.15},{"kind":"verified_price_increase","providerId":"stytch","maxPriceIncreasePct":25},{"kind":"live_rail_exhaustion_or_degradation","providerId":"stytch","immediateOverrideUrl":"/api/decide?jtbd=agent-m2m-identity&exhausted=stytch"}],"submissionSpec":{"falsifyEndpoint":"/api/falsify?jtbd=agent-m2m-identity","outcomesEndpoint":"POST /api/feedback","correctionsEndpoint":"POST /api/corrections","payloadTemplate":{"agentIdentity":"agent:<your-agent-id>","jtbdId":"agent-m2m-identity","providerId":"workos","outcome":"worked","detail":"Comparative production evaluation on agent-m2m-identity (n>=10 tasks) with Countersign receipt.","confidence":"high","receipt":{"countersign":{"claim_id":"cs-00000000","status":"verified","evidence_tier":"outcome_verified","counts_as_verified":true}}}}},"whatWouldChangePick":["WorkOS (workos) outperforms Stytch (stytch) by >= 0.48 outcome points (or >= 15% worked-rate delta) across >= 10 Countersign-verified production outcomes.","A verified price increase > 25% on Stytch's representative SKU for agent-m2m-identity without a corresponding capability gain.","Live caller rail exhaustion (?exhausted=stytch) or sustained >= 30% degraded/failed rate in verified production outcomes."],"routePlan":{"jtbdId":"agent-m2m-identity","primary":{"providerId":"stytch","name":"Stytch","overall":8.21,"scoreBand":{"low":7.6,"mid":8.2,"high":8.8,"halfWidth":0.6,"basis":"editorial_prior","display":"7.6–8.8 (editorial prior)"},"scoreLayers":{"editorialPrior":8.21,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","role":"primary","reason":"Editorial Depot Pick for Machine-to-machine agent identity; healthy/eligible under caller constraints."},"fallback":[{"providerId":"workos","name":"WorkOS","overall":8.54,"scoreBand":{"low":7.9,"mid":8.5,"high":9.1,"halfWidth":0.6,"basis":"editorial_prior","display":"7.9–9.1 (editorial prior)"},"scoreLayers":{"editorialPrior":8.54,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","role":"fallback","reason":"Ranked fallback route for Machine-to-machine agent identity."},{"providerId":"auth0","name":"Auth0 (Okta)","overall":8.08,"scoreBand":{"low":7.5,"mid":8.1,"high":8.7,"halfWidth":0.6,"basis":"editorial_prior","display":"7.5–8.7 (editorial prior)"},"scoreLayers":{"editorialPrior":8.08,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","role":"fallback","reason":"Ranked fallback route for Machine-to-machine agent identity."},{"providerId":"clerk","name":"Clerk","overall":8.25,"scoreBand":{"low":7.7,"mid":8.3,"high":8.9,"halfWidth":0.6,"basis":"editorial_prior","display":"7.7–8.9 (editorial prior)"},"scoreLayers":{"editorialPrior":8.25,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-10-19","role":"fallback","reason":"Ranked fallback route for Machine-to-machine agent identity."},{"providerId":"infisical","name":"Infisical","overall":8.44,"scoreBand":{"low":7.8,"mid":8.4,"high":9,"halfWidth":0.6,"basis":"editorial_prior","display":"7.8–9.0 (editorial prior)"},"scoreLayers":{"editorialPrior":8.44,"measuredBenchmark":null,"verifiedOutcomeScore":null,"verifiedOutcomeCount":0,"accountRuntimeState":"unprobed"},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","role":"fallback","reason":"Ranked fallback route for Machine-to-machine agent identity."}],"disqualified":[],"expectedRegret":{"scoreDeltaVsUnconstrainedPick":0,"unconstrainedPickId":"stytch","activePrimaryId":"stytch","summary":"0.00 score regret: unconstrained editorial pick satisfies all caller constraints."},"evidenceAgeDays":{"editorialScoreAgeDays":44,"pricingVerifiedAgeDays":1,"editorialPriorAsOf":"2026-09-14","pricingLastVerifiedAt":"2026-10-27"},"confidenceBand":{"low":7.6,"mid":8.2,"high":8.8,"halfWidth":0.6,"basis":"editorial_prior","display":"7.6–8.8 (editorial prior)"},"constraintsApplied":false,"constraintBundle":{"task":null,"jtbd":"agent-m2m-identity","quotaExhausted":[],"degraded":[],"healthy":[],"budgetUsd":null,"maxLatencyMs":null,"region":null,"privacy":null,"exit":[],"existing":[]}},"pricingLastVerifiedAt":"2026-10-27","editorialPriorAsOf":"2026-09-14","tie":false,"scoreGap":-0.33,"decidingFactor":null,"tieNote":null,"rationale":"Auth category; privacy + maturity. Not a full W3C DID network — pragmatic M2M. Confidence: medium-high.","whenNotTopPick":"Enterprise SSO/SCIM is the buyer (WorkOS/Auth0), or secrets injection is the only need (Infisical).","skipTopPick":false,"skipReason":null,"matchedConstraints":[],"pricingSummary":"As of 2026-09-14 (stytch.com/pricing B2B): Pay as you go $0 base — 10,000 MAU/agents included, unlimited orgs, 5 SSO/SCIM connections ($125/extra), 1,000 M2M tokens, 10k fingerprints then $0.005 each; brand customization $99/mo. Enterprise quote (99.99% SLA, HIPAA/BAA). Note: Sty…","cite":"Depot Pick for agent-m2m-identity: stytch (asOf 2026-09-14). See GET /api/jtbds/agent-m2m-identity + GET /api/methodology.","nextActions":[{"step":1,"title":"Inspect full JTBD + embeds","href":"/api/jtbds/agent-m2m-identity?embed=providers","why":"Confirm pick, runners-up, and methodology notes."},{"step":2,"title":"Quote sourced SKUs","href":"/api/quote?jtbd=agent-m2m-identity","why":"Depot Pick SKUs plus the cheapest sourced SKU whose unit matches this job. Does not change the pick. Does not blend input and output or borrow a chat rate for a non-chat job."},{"step":3,"title":"Open provider detail","href":"/api/providers/stytch","why":"Scores, pricingNotes, strengths/weaknesses, communitySignals (claims only)."},{"step":4,"title":"Cite methodology","href":"/api/methodology","why":"Required when publishing a Depot Pick citation."},{"step":5,"title":"Grab badge SVG","href":"/api/badge?type=depot-pick&jtbd=agent-m2m-identity","why":"Embed in README / agent passport."},{"step":6,"title":"Post production insight","method":"POST","href":"/api/insights","why":"Unverified until curated; never auto-mutates official scores."}],"honesty":["Do not invent scores or benches.","Insights are claims until curated/reviewed; they never silently mutate official scores.","lockInRisk higher = more lock-in (worse).","normalizedUsdPerMillionTokens is set only for a single sourced token row. Otherwise null, with a machine-readable reason. Do not coerce GPU, minute, or per-1k search units.","Runners-up are not Depot Picks.","Depot overall is editorial_weighted, not Arena Elo and not an Artificial Analysis index."],"asOf":"2026-09-14","depth":{"whenNotToUse":{"text":"Enterprise SSO/SCIM is the buyer (WorkOS/Auth0), or secrets injection is the only need (Infisical).","source":"editorial `whenNotTopPick` (data/jtbds.json)"},"whenNotToUseReason":null,"runnerUp":{"providerId":"workos","name":"WorkOS","overallForJob":8.54,"pickOverallForJob":8.21,"beatsPickOn":["capabilityFit","latencyReliability","developerDx","privacyPosture","maturity"],"source":"first resolvable entry of the job's editorially ranked `runnersUpIds`; scores are stored job-weighted scores"},"runnerUpReason":null,"lockIn":{"pickLockInRisk":4.2,"runnerUpLockInRisk":4.5,"scale":"0–10 stored curated estimate; higher = more lock-in (worse)","pickExitSignals":[],"runnerUpExitSignals":[],"pickNotes":[],"selfHostFallback":[],"migration":"The pick has lower stored lock-in risk than runner-up WorkOS (4.2 vs 4.5).","migrationReason":null,"derivedFrom":"stored lockInRisk scores, provider tags (oss, self-host, openai-compat, open-models), free rows that list this job, and verbatim provider notes. No migration guide was invented."}},"citation":{"text":"Agent Provider Depot (v0.12.157), Depot Pick for agent-m2m-identity: stytch, scores as of 2026-09-14, retrieved 2026-10-28. https://getagentdepot.com/jtbds/agent-m2m-identity","markdown":"[Agent Provider Depot](https://getagentdepot.com/jtbds/agent-m2m-identity) (v0.12.157) — Depot Pick for `agent-m2m-identity`: **stytch** (scores as of 2026-09-14, retrieved 2026-10-28)","fields":{"publisher":"Agent Provider Depot","version":"0.12.157","role":"depot_pick","jtbdId":"agent-m2m-identity","providerId":"stytch","scoreAsOf":"2026-09-14","retrievedOn":"2026-10-28","page":"https://getagentdepot.com/jtbds/agent-m2m-identity","api":"https://getagentdepot.com/api/decide?jtbd=agent-m2m-identity"},"howToCite":"Cite Depot as an editorial, dated recommendation, not a benchmark: name the job, the Depot Pick (or runner-up), the score asOf date and the day you retrieved it, and link the job page. Format: “Agent Provider Depot (v{version}), Depot Pick for {jobId}: {providerId}, scores as of {scoreAsOf}, retrieved {retrievedOn}. {baseUrl}/jtbds/{jobId}”. Quote prices only with their own sourceUrl and asOf. If the pick's score is stale (freshness.pick.score.stale), say so."},"freshness":{"pick":{"score":{"asOf":"2026-09-14","ageDays":44,"stale":true,"staleAfterDays":30,"reason":null},"lastReviewed":{"asOf":"2026-09-14","ageDays":44,"stale":true,"staleAfterDays":30,"reason":null},"sourceCheck":{"checkedAt":"2026-10-27","sourceUrls":2,"sourcesReachable":2,"pricingRows":0,"pricingRowsReconfirmed":0,"note":"A source re-check confirms the page is reachable and, for pricing rows, that the stored amount and SKU name appear on it. It does not re-derive or change the score.","reason":null}},"scoreAsOf":"2026-09-14","editorialPriorAsOf":"2026-09-14","pricingLastVerifiedAt":"2026-10-27","pickLastReviewed":"2026-09-14","runnersUpScoreAsOf":["2026-09-14","2026-09-14","2026-10-19","2026-09-14"],"contractAsOf":"2026-10-03","pricingShape":"prose_notes_only","normalizedUsdPerMillionTokens":null,"normalizationStatus":"unavailable","normalizationReason":"no_sourced_price"},"pricingContract":{"normalizedUsdPerMillionTokens":null,"normalizationStatus":"unavailable","normalizationReason":"no_sourced_price","shape":"prose_notes_only","filterable":false,"priceSortEligible":false,"priceSortKeyUsdPerMillionInputTokens":null,"rows":[],"notesExcerpt":"As of 2026-09-14 (stytch.com/pricing B2B): Pay as you go $0 base — 10,000 MAU/agents included, unlimited orgs, 5 SSO/SCIM connections ($125/extra), 1,000 M2M tokens, 10k fingerprints then $0.005 each; brand customization $99/mo. Enterprise quote (99.99% SLA, HIPAA/BAA). Note: Sty…","notesCheck":{"status":"no_known_contradiction","pairs":[],"review":null,"note":null},"lastReviewed":"2026-09-14","scoreAsOf":"2026-09-14","website":"https://stytch.com","doNotParse":"Do not parse pricingNotes. Use rows only. normalizedUsdPerMillionTokens is a single number only when this provider has exactly one sourced token row. Input/output, context tiers, and non-token units stay null at this level.","gap":"No sourced price row for this provider. pricingNotes stay prose. See research/gaps.md."},"links":{"jtbd":"/jtbds/agent-m2m-identity","jtbdApi":"/api/jtbds/agent-m2m-identity","leaderboard":"/api/leaderboards?jtbd=agent-m2m-identity","methodology":"/api/methodology","badge":"/api/badge?type=depot-pick&jtbd=agent-m2m-identity","decide":"/api/decide?jtbd=agent-m2m-identity","humanPage":"/jtbds/agent-m2m-identity","alternatives":"/api/alternatives?provider=stytch","canonical":"/api/canonical","quote":"/api/quote?jtbd=agent-m2m-identity","falsify":"/api/falsify?jtbd=agent-m2m-identity"},"constraintBundle":{"task":null,"jtbd":"agent-m2m-identity","quotaExhausted":[],"degraded":[],"healthy":[],"budgetUsd":null,"maxLatencyMs":null,"region":null,"privacy":null,"exit":[],"existing":[]},"stackContext":{"host":null,"framework":null,"repo":null,"lang":null,"existing":[],"volume":null,"sender":null,"detectedFromTask":[]},"keep":null,"contextAdvice":null,"communityFeedback":{"pickOnThisJob":{"failed":0,"degraded":0,"worked":0,"insights":0,"withVerifiedReceipt":0,"failureModes":{},"latestAt":null,"note":"Agent-reported claims (unverified unless a receipt is verified by Depot's re-check). They never change scores or picks."},"outcomes":{"job":{"n":0,"worked":0,"degraded":0,"failed":0,"failureModes":{},"verifiedReports":0,"contributors":0,"excluded":{"seed_editorial":0,"test":0,"notFeedback":0},"reason":"no_submitted_outcome_reports_yet"},"pick":{"providerId":"stytch","n":0,"worked":0,"degraded":0,"failed":0,"failureModes":{},"evidenceTiers":{"agent_claim":0,"self_declared":0,"reference_checked":0,"outcome_verified":0},"reason":"no_submitted_outcome_reports_yet"},"scoresMutated":false,"more":"/api/outcomes?jtbd=agent-m2m-identity"},"report":"POST /api/feedback {agentIdentity, outcome: failed|degraded|worked, detail, providerId, jtbdId, failureModeId?, receipt?}"}}