Markets · bedrock market · provisional
Identity and Auth
Platform and standards market. The Kin Score Market layer reads each provider in its market:
who it integrates with, how deep those integrations go, and where the market publishes its own structure.
Methodology.
25providers measured
22 (88.0%)declare their own
1 (4.0%)covered by others only
1 (4.0%)distribution only (sell through, not integrations)
1 (4.0%)undeclared
4declare compatibility (report only, not weighted)
0in-market workflows shown (4 bridges)
Provisional. Provisional and unweighted: the Market layer is not part of the composite or agent readiness. Leader lists are read within a position, never as one ranking. A provider that declares nothing we can
read is shown as undeclared, with no number: we never infer integrations.
Where this market publishes its structure
- OpenID Foundation certified implementations machine-readable
- FIDO Metadata Service (MDS3) machine-readable
- Okta Integration Network machine-readable
- Ping Identity Marketplace machine-readable
- FIDO Certified Products directory not machine-readable: migration freeze
- Auth0 Marketplace not machine-readable: 401
- Microsoft Entra app gallery not machine-readable: tenant token
- OneLogin connector catalog not machine-readable: empty to non-browsers
Own = declares at least one integration itself; covered = visible only because an aggregator, standards body, regulator or partner contract names it; distribution-only = listed only on cloud marketplaces it sells through, a channel reported beside, never counted as its own declared integrations; undeclared = nothing we can read, so no number; declares_compatibility = providers with a `compatible` shape vote, report only (kin, 2026-10-13): never counted as own, never in depth or position.
Taxonomy how this market maps onto apis.io
Derived 2026-10-23 from the 25 providers in this market we could resolve in the
catalog. The percentage is the share of those providers carrying each one; it describes the market, not the tag or industry. Tag groups have no page of their own yet, so they are listed unlinked.
| Tags | Authentication 100%, Identity Federation 84%, Authorization 68%, OpenID Connect 68%, Identity 64%, SSO 44%, Identity and Access Management 36%, Security 32%, SCIM 32%, SAML 28%, MCP 24%, MFA 24% |
|---|
| Tag groups | Authentication 100%, Education 84%, Organization 60%, Identity and Access Management 36%, Security 32%, SCIM 32%, MCP 24% |
|---|
| Industries | Cybersecurity & Identity 100% |
|---|
| Areas | Authentication 100%, Security 36% |
|---|
| Capabilities | Cybersecurity Management 96%, SaaS Tenant Management 24% |
|---|
share of resolved cohort carrying it; tags >=0.20 & >=3 members (max 12, junk dropped), tag_groups >=0.20 (cooccurrence, non-cross-cutting; max 8), industries >=0.20 (max 6), areas >=0.10 (max 6; areas are keyword-matched and sparse), capabilities L1 >=0.20 (max 8); derive-market-taxonomy.py
Leaders by position (provisional)
Provisional: grouped by position, depth compared within a position only. Distribution (cloud marketplaces) and iPaaS bridges are counted beside
position, never inside it. Unknown-builder listings are left out of position shares and counted here.
gravity 1 · other companies invest to build on it
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Okta |
71.0 |
8420 |
1746 / 6674 |
6639 |
4 |
36 |
partner-built 21%, unknown 78% |
builds-on 11 · publishes apps on other platforms' stores
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| PropelAuth |
51.7 |
3 |
0 / 3 |
0 |
0 |
0 |
builds-on-platform 100% |
| WorkOS |
51.7 |
6 |
0 / 6 |
0 |
0 |
0 |
standard 17%, builds-on-platform 83% |
| Ory |
51.1 |
6 |
0 / 6 |
0 |
1 |
0 |
standard 33%, builds-on-platform 50%, distribution 17% |
| Authentik |
49.1 |
11 |
0 / 11 |
0 |
3 |
0 |
standard 27%, builds-on-platform 45%, distribution 27% |
| Beyond Identity |
48.9 |
8 |
0 / 8 |
0 |
1 |
0 |
standard 12%, builds-on-platform 75%, distribution 12% |
| Stytch |
47.1 |
5 |
0 / 5 |
0 |
1 |
0 |
standard 20%, builds-on-platform 60%, distribution 20% |
| Descope |
46.0 |
8 |
0 / 8 |
0 |
2 |
0 |
standard 12%, builds-on-platform 62%, distribution 25% |
| OneLogin |
45.4 |
7 |
0 / 7 |
0 |
0 |
1 |
ipaas-bridge 14%, builds-on-platform 86% |
| Auth0 |
41.6 |
13 |
0 / 13 |
0 |
2 |
4 |
ipaas-bridge 31%, standard 8%, covered 15%, builds-on-platform 31%, distribution 15% |
| Frontegg |
40.7 |
4 |
0 / 4 |
0 |
0 |
1 |
ipaas-bridge 25%, standard 25%, builds-on-platform 50% |
| FusionAuth |
24.3 |
16 |
0 / 16 |
0 |
0 |
0 |
builds-on-platform 100% |
regulated 1 · named in a regulator's register or partners' contracts
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Duo Security |
65.0 |
3 |
0 / 3 |
0 |
0 |
0 |
contract 67%, standard 33% |
standard 6 · listed by a voluntary standard's own directory
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Gluu |
58.9 |
4 |
0 / 4 |
0 |
0 |
0 |
standard 75%, builds-on-platform 25% |
| ForgeRock |
55.6 |
5 |
0 / 5 |
0 |
0 |
0 |
standard 60%, builds-on-platform 40% |
| Zitadel |
54.9 |
6 |
0 / 6 |
0 |
0 |
0 |
standard 50%, builds-on-platform 50% |
| Keycloak |
48.4 |
8 |
0 / 8 |
0 |
1 |
1 |
ipaas-bridge 12%, standard 50%, builds-on-platform 25%, distribution 12% |
| Yubico |
45.7 |
9 |
0 / 9 |
0 |
3 |
0 |
standard 44%, builds-on-platform 22%, distribution 33% |
| Authlete |
39.9 |
11 |
0 / 11 |
0 |
7 |
0 |
standard 18%, builds-on-platform 18%, distribution 64% |
core 1 · builds the connectors its customers need
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Ping Identity |
68.8 |
1202 |
89 / 1113 |
0 |
0 |
0 |
partner-built 31%, provider-built 68% |
mixed 2 · no single mode dominates
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Transmit Security |
48.5 |
6 |
0 / 6 |
0 |
2 |
0 |
standard 33%, builds-on-platform 33%, distribution 33% |
| Clerk |
33.2 |
6 |
0 / 6 |
0 |
0 |
2 |
ipaas-bridge 33%, standard 17%, covered 17%, builds-on-platform 33% |
long-tail 1 · reached only through iPaaS bridges
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Microsoft Entra |
7.5 |
5 |
0 / 5 |
0 |
0 |
5 |
ipaas-bridge 100% |
distribution 1 · only sells through cloud marketplaces
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Strivacity |
28.8 |
3 |
0 / 3 |
0 |
3 |
0 |
distribution 100% |
undeclared 1 · declares nothing we can read: no number
| Provider | Depth | Integrations | In / out | Unknown builder | Distribution | iPaaS bridge | Mix |
|---|
| Amazon Cognito |
undeclared | - | - | - | - | - | |
Workflows
No in-market workflows yet; bridges: 4 (2 not yet mapped to a capability).
In-market workflows only: a step on the market provider's side maps to this market's business capabilities (BC-620.20, BC-4230.50, BC-4270.40), and the partner is not a generic export/notify app. Other workflows are counted as bridges (including any whose steps do not resolve to a capability yet). Methodology.