You run developer relations at a company that sells authentication. Last week a prospect asked you a simple question: can an AI agent register with your API, get a token, and act on a user's behalf? You said yes, and pointed to your docs. The docs are good. Everyone says so. But you are no longer sure the answer is as clean as you told them.
So you look at how the market sees companies like yours. The Authentication tag on apis.io holds 388 providers and 2,045 APIs, and the number that frames it is 49.3. That is the gap, in percentage points, between the share of this tag with auth clarity lit on the agent readiness measure, 87.2%, and the share of the rest of the catalog, 37.9%. The category that sells authentication explains its own authentication better than anyone.
You also learn what the tag really is. The helper that reads the catalog splits it into identity and single sign-on at 183 providers, backend-as-a-service auth at 27, and crypto wallets and key management at 16, with 162 unassigned. The tag also folds in every provider that tags itself OAuth, so a CRM, a newsletter platform and an electronic health record show up in it. The post sets those aside and looks at the five companies whose product is authentication.
Microsoft Entra ID leads at 90.2 on the Kin Score, exemplar, with access clarity at 100.0 and operational transparency at 97.4. Kinde scores 88.7, exemplar, with developer ergonomics at 91.1, the highest of the five. Twilio scores 86.0, exemplar, here for Verify, its one-time passcode and silent network authentication product. Appwrite scores 83.7, exemplar, held back by operational transparency at 57.9. Aembit scores 75.9, exemplar, for workload and non-human identity. Contract governance is the soft spot for all five, from 45.5 at Entra ID and Appwrite down to 31.8 at Aembit.
Across the whole tag, the picture is strong. The 383 scored members average 38.6 against 21.4 for the other 37,632, and the median is 37.4 against 14.6. Minimal holds 8.2% of Authentication against 38.5% of the rest. Almost nobody here has published nothing.
Then you reach the part that matters for your prospect. Agent readiness is ahead too, but on the human-facing half. The mean is 23.5 against 12.2. Human-only holds 21.4% of the tag against 53.4% of the rest, and agent-ready holds 34.8% against 14.5%. The dimensions the category lights up are the ones a developer reads: error semantics at 50.1% against 22.6%, a rate limit signal at 56.7% against 31.8%. Delegated identity, the one dimension specifically about an agent acting on a user's behalf, is lit for 38.9% against 12.7%.
The machine-readable dimensions are another story. An MCP server is 23.2% against 23.1%, a gap of 0.1. Protected resource metadata, the discovery document an agent reads to learn where to get a token, is 13.1% against 10.3%, a gap of 2.8. Dynamic client registration is 14.6% against 8.0%. A well-known catalog is 5.0% against 8.6%, and an agent card is 1.8% against 2.6%, both below the market.
The five show how the gate works. Agent-native requires idempotency and a stable error envelope on top of the score floor. Twilio at 47.1 is the only one of the five that is agent-native, and the only one whose idempotency grade is verified. Entra ID and Kinde have idempotency documented and hold agent-ready. Appwrite and Aembit have idempotency dark and hold agent-ready. Appwrite and Aembit are also the two with protected resource metadata, dynamic client registration and delegated identity all lit, which is the trio the MCP authorization flow asks a resource server for. The two companies that published the plumbing for an agent to register and get a token have not written down how that agent retries a write.
Here is the turn, and it is aimed at you. This category wrote the standards the agents are now using. Protected resource metadata and dynamic client registration are OAuth documents, and the companies in this tag implement OAuth for everyone else. Yet only 13.1% and 14.6% of them publish those two documents for their own APIs, against 10.3% and 8.0% of a market that mostly consumes OAuth rather than provides it.
So you go back to your prospect with a more honest answer. Your prose is excellent: the 49.3-point lead is a lead in the pages that tell a developer which header to send. The lead on the documents a machine reads is 2.8 points and 6.6 points. Authentication knows how to explain itself to a person. It has not yet decided to explain itself to an agent, and it is the one category that cannot claim it does not know how. What you take away is a short list: check whether you publish protected resource metadata, whether agents can register dynamically, and whether you have written down how a write is retried.
Read the original: https://apis.io/2026/11/06/authentication-leads-the-market-by-49-3-points-on-auth-clarity-and-2-8-on-protected-resource-metadata/