The Authentication tag on apis.io holds 388 providers and 2,045 APIs, and the number that frames it is 49.3. That is the gap, in percentage points, between the share of this tag with auth clarity lit on our agent readiness measure, 87.2%, and the share of the rest of the catalog, 37.9%. The category that sells authentication explains its own authentication better than anyone. The number that undercuts it is 2.8. That is the gap on protected resource metadata, the discovery document an agent reads to learn where to get a token: 13.1% of Authentication publishes one, against 10.3% of everyone else. The tag is three things, and the helper that reads the catalog splits it into identity and single sign-on at 183 providers, backend-as-a-service auth at 27, and crypto wallets and key management at 16, with 162 unassigned. This post is about the companies whose product is authentication, and that needs saying, because the tag also folds in every provider that tags itself OAuth.
The five, and why the tag page’s own order was not used. Microsoft Entra ID leads at 90.2 on the Kin Score, exemplar, with access clarity at 100.0 and operational transparency at 97.4 across 186 API pages for directory, sign-in and identity governance. Kinde scores 88.7, exemplar, on 31 API pages for customer identity, with developer ergonomics at 91.1 the highest of the five. Twilio scores 86.0, exemplar, on 153 API pages, and is here for Verify, its one-time passcode and silent network authentication product, with access clarity at 100.0 and operational transparency at 94.7. Appwrite scores 83.7, exemplar, on 44 API pages, the one backend-as-a-service member of the five, carried by access clarity at 92.1 and developer ergonomics at 86.9 and held back by operational transparency at 57.9. Aembit scores 75.9, exemplar, on 38 API pages for workload and non-human identity, with access clarity at 93.4. Aembit ranks eleventh on the tag page. Between it and Appwrite sit Zoho CRM at 86.0, Kit at 79.7 and drchrono at 78.6, three OAuth consumers that reach this tag because their own tag lists say OAuth and the tag treats OAuth as a variant of Authentication, two Cvent listings at 76.7 and 76.6, and a second Microsoft Entra listing at 76.3. A CRM, a newsletter platform and an electronic health record are not what a reader searching for authentication providers came to compare, so they are named here and not profiled. Contract governance is the soft spot for all five, from 45.5 at Entra ID and Appwrite down to 31.8 at Aembit.
Against the rest of the catalog, the composite is well ahead. The 383 scored members average 38.6 against 21.4 for the other 37,632, and the median is 37.4 against 14.6. A median of 37.4 against 14.6 is a category where the typical member, not just the leaders, has published a contract and priced access. The band ladder confirms it from both ends. Exemplar holds 7.0% of the tag against 1.9% of the rest, strong holds 13.9% against 5.6%, and developing holds 24.2% against 10.4%. Minimal holds 8.2% of Authentication against 38.5% of the rest. On 4,802 APIs against 185,355, this is a category where almost nobody has published nothing, which is what you would expect from companies whose product is the thing every other API has to integrate first.
Agent readiness is ahead too, and it is ahead on the human-facing half. The mean is 23.5 against 12.2. Human-only holds 21.4% of the tag against 53.4% of the rest, agent-ready holds 34.8% against 14.5%, and agent-native holds 2.6% against 1.9%. The dimensions the category lights up far more than the market are the ones a developer reads: auth clarity at 87.2% against 37.9%, spec presence at 61.9% against 32.2%, error semantics at 50.1% against 22.6%, operation distinctiveness at 50.4% against 23.6%, and a rate limit signal at 56.7% against 31.8%. Delegated identity, the one dimension that is specifically about an agent acting on a user’s behalf, is lit for 38.9% against 12.7%. The dimensions the category does not light are the machine-readable ones. An MCP server is 23.2% against 23.1%, a gap of 0.1. Protected resource metadata is 13.1% against 10.3%. Dynamic client registration is 14.6% against 8.0%. A well-known catalog is 5.0% against 8.6%, and an agent card is 1.8% against 2.6%, both below the market. Consent identity is 0.8% against 0.3%.
The five show the gate working on the grade, not the checkbox. Agent-native requires idempotency and a stable error envelope on top of the score floor, and it reads the grade of each. Twilio at 47.1 is agent-native, the only one of the five, and the only one whose idempotency grade is verified. Entra ID at 57.9 and Kinde at 50.9 both have idempotency lit at documented and hold agent-ready. Appwrite at 56.3 and Aembit at 52.7 have idempotency dark and hold agent-ready. Appwrite and Aembit are also the two of the five with protected resource metadata, dynamic client registration and delegated identity all lit, which is the exact trio the MCP authorization flow asks a resource server for. The two companies that have published the plumbing for an agent to register and get a token are the two that have not written down how that agent retries a write.
This category wrote the standards the agents are now using, and it is publishing them at the market’s rate. Protected resource metadata and dynamic client registration are OAuth documents. The companies in this tag are the ones that implement OAuth for everyone else. Yet 13.1% and 14.6% of them publish those two documents for their own APIs, against 10.3% and 8.0% of a market that mostly consumes OAuth rather than provides it. The 49.3-point lead on auth clarity is a lead in prose, in the pages that tell a developer which header to send. The lead on the documents a machine reads is 2.8 points and 6.6 points. Authentication knows how to explain itself to a person. It has not yet decided to explain itself to an agent, and it is the one category that cannot claim it does not know how.