The Authentication tag at apis.io/tags/authentication/ is carried by 1,338 providers and 1,207 APIs — one of the widest tags on the network. Its aggregate Kin Score is 35.8, which places the tag itself in the emerging band.
Read those two numbers together and you have the most uncomfortable finding in the catalog. Authentication is the most broadly implemented capability we track, and one of the worst described.
Breadth without depth
1,338 providers touch authentication. That is roughly one in nineteen providers in the catalog carrying the tag — and the true figure is higher, because every API with a credential model does authentication whether or not it is tagged for it.
Against that breadth, a 35.8 composite is dismal. For comparison, the Machine Learning area covered this week has eleven providers above 70 at its top. The Authentication tag as a whole sits below 36.
Why the gap is structural
Authentication is the surface providers document least well precisely because they consider it solved. The reasoning runs: everyone knows OAuth, everyone knows Bearer tokens, so a sentence pointing at the token endpoint is sufficient.
It is not sufficient, and the catalog shows why. What integrators actually need to know is never the protocol name:
- Which grant types are actually supported, versus which are in the OAuth spec
- Token lifetime, and whether refresh is available or you re-authenticate
- Whether scopes are enforced per-endpoint or per-token
- What happens on expiry mid-request — 401, 403, or a redirect
- Whether the sandbox and production credential models are the same shape
None of that is implied by “we use OAuth 2.0.” All of it is required to build a client that does not break at 3am. And almost none of it is machine-readable across these 1,338 providers.
The agent consequence
This is the tag where the human-versus-agent gap bites hardest. A developer hitting an under-described auth surface reads the docs, experiments, and figures it out in an afternoon. An agent cannot. It either resolves the credential model deterministically from the specification or it fails.
The catalog carries 1,747 scope definitions — real, enumerated OAuth scopes — browsable at apis.io/scopes/. Set against 1,338 providers carrying the authentication tag, that is the measure of how few have made their permission model explicit rather than prose.
Takeaway
Authentication is the most-implemented and least-described capability in the catalog: 1,338 providers, 1,207 APIs, a 35.8 composite. Everyone builds it, almost nobody specifies it, and the assumption that “it’s just OAuth” is exactly what keeps the score there.
Browse the tag at apis.io/tags/authentication/.