In 2026 Cloudflare sits in front of more identity decisions than most identity products: who reaches internal apps, which bots reach your sign-up form, which AI agents reach your site and which MCP servers your staff's agents may use. What each product does, and how it combines with Cognito, Auth0 or Okta behind it.
Your users, groups and passwords still live in an identity provider: Okta, Entra, Google, Cognito, Auth0. What Cloudflare adds is enforcement at the edge, before a request reaches your application: checking that a person signed in with that provider, that their device passes posture checks, that a bot is a bot you allow, or that an agent is who it claims to be. In 2026 that edge also became the place many companies govern AI agents.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Put admin panels, dashboards and internal APIs behind Access with sign-in through your workforce identity provider. With Managed OAuth turned on, the same apps become usable by staff's AI agents with the user's own consent — no shared credentials, and every agent action attributable to a person.
Bots creating accounts and stuffing credentials are the most common attack on a customer login. Turnstile on the sign-up, sign-in and password-reset forms, with server-side verification of the token before calling Cognito or Auth0, stops most of it before it costs you SMS and email charges. Add rate limiting on those endpoints at the edge.
Some agent traffic is your customers' assistants doing useful work; some is scraping; some impersonates the first to do the second. Cloudflare's signed-agent classification, built on Web Bot Auth, lets you allow the operators you trust — OpenAI's ChatGPT agent was in the first group to sign — and challenge or block the rest by verified identity rather than by user-agent string.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Identity for AI Agents in 2026: The Agent Is Not the User
When software acts for people, identity has to answer new questions: whose permissions does the agent carry, who approved this action, and how does your API tell a real agent from an impersonator? The patterns that work (on-behalf-of tokens, asynchronous approval with CIBA, Cross App Access, MCP's OAuth model and signed agent traffic) and what to build first.
Read
Cognito vs Better Auth in 2026: Cost, Control, and Sign-In for AI Agents
Amazon Cognito is a managed service billed per monthly active user; Better Auth is an open-source TypeScript library that keeps users in your own database. AI changed the comparison in two ways: coding agents now write most of the integration code, and your users increasingly connect AI agents and MCP clients to your product. Prices, what each supports for agents, and how to choose.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.