{"id":"agent-m2m-identity","slug":"agent-m2m-identity","name":"Machine-to-machine agent identity","shortName":"Agent M2M identity","problemStatement":"Issue non-human identities, mTLS/JWT, and scoped tokens so agents authenticate to APIs without sharing user sessions.","whenNotTopPick":"Enterprise SSO/SCIM is the buyer (WorkOS/Auth0), or secrets injection is the only need (Infisical).","categoryIds":["cat-auth-payments"],"depotPickProviderId":"stytch","depotPickRationale":"Auth category; privacy + maturity. Not a full W3C DID network — pragmatic M2M. Confidence: medium-high.","runnersUpIds":["workos","auth0","clerk","infisical"],"weights":{"capabilityFit":0.2,"pricePerformance":0.1,"latencyReliability":0.12,"developerDx":0.1,"privacyPosture":0.3,"lockInRisk":0.08,"maturity":0.1},"methodologyNotes":"Auth category; privacy + maturity. Not a full W3C DID network — pragmatic M2M. Confidence: medium-high.","tags":["identity","m2m","auth","agents"],"depth":{"whenNotToUse":{"text":"Enterprise SSO/SCIM is the buyer (WorkOS/Auth0), or secrets injection is the only need (Infisical).","source":"editorial `whenNotTopPick` (data/jtbds.json)"},"whenNotToUseReason":null,"runnerUp":{"providerId":"workos","name":"WorkOS","overallForJob":8.54,"pickOverallForJob":8.21,"beatsPickOn":["capabilityFit","latencyReliability","developerDx","privacyPosture","maturity"],"source":"first resolvable entry of the job's editorially ranked `runnersUpIds`; scores are stored job-weighted scores"},"runnerUpReason":null,"lockIn":{"pickLockInRisk":4.2,"runnerUpLockInRisk":4.5,"scale":"0–10 stored curated estimate; higher = more lock-in (worse)","pickExitSignals":[],"runnerUpExitSignals":[],"pickNotes":[],"selfHostFallback":[],"migration":"The pick has lower stored lock-in risk than runner-up WorkOS (4.2 vs 4.5).","migrationReason":null,"derivedFrom":"stored lockInRisk scores, provider tags (oss, self-host, openai-compat, open-models), free rows that list this job, and verbatim provider notes. No migration guide was invented."}},"freshness":{"pick":{"score":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"lastReviewed":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"sourceCheck":{"checkedAt":"2026-10-27","sourceUrls":2,"sourcesReachable":2,"pricingRows":0,"pricingRowsReconfirmed":0,"note":"A source re-check confirms the page is reachable and, for pricing rows, that the stored amount and SKU name appear on it. It does not re-derive or change the score.","reason":null}}},"depotPick":{"id":"stytch","slug":"stytch","name":"Stytch","tagline":"Auth pick when agents/M2M + org SSO matter more than Clerk's consumer UI kit. Watch Twilio integration…","overall":8.21},"runnersUp":[{"id":"workos","slug":"workos","name":"WorkOS","tagline":"When your first big customer asks for Okta SSO tomorrow, WorkOS is how you say yes without a rewrite.","overall":8.54},{"id":"auth0","slug":"auth0","name":"Auth0 (Okta)","tagline":"Enterprise identity Swiss Army knife. For startups, Clerk/WorkOS usually hurt less.","overall":8.08},{"id":"clerk","slug":"clerk","name":"Clerk","tagline":"Depot default auth for agent products with users. WorkOS when enterprise SSO is the main job.","overall":8.25},{"id":"infisical","slug":"infisical","name":"Infisical","tagline":"Depot default for agent secrets when you want OSS exit + Agent Proxy (placeholders instead of raw keys in the…","overall":8.44}]}