Arcade Review 2026: Agent Authorization, Tools, and Pricing

Short answer

Arcade is worth testing when an agent must act in a user's Gmail, Drive, Slack, GitHub, or another authenticated service without turning OAuth and token custody into bespoke application code. Its strongest value is the authorization boundary, not the size of its tool catalog. Teams still need least-privilege scopes, per-action confirmation, idempotency, audit review, and a reliable way to revoke access.

Best for

• Agents acting in user-owned SaaS accounts
• Teams centralizing OAuth and tool governance
• Developers shipping MCP-based actions

Look elsewhere if

• High-risk writes without confirmation
• Workloads that cannot use third-party token custody
• Simple agents with one stable internal API

What Arcade verifiably does

First-party material describes managed OAuth and token storage, runtime authorization, more than 7,500 tools across 81 MCP servers, custom tools and MCP servers, policy enforcement, registries, version control, OpenTelemetry logs, and integrations with common agent frameworks. Enterprise options include VPC and air-gapped deployment, SSO, RBAC, audit logs, and a private registry.

Important limitations

An agent action can send messages, alter records, or expose data even when authentication works perfectly. Broad OAuth scopes, stale consent, prompt injection, repeated retries, and confusing tool descriptions remain application risks. Authentication events and calls are separate meters, while downstream APIs may add quotas and fees. The vendor becomes a sensitive credential and execution dependency.

Arcade pricing

Arcade lists Free at $0 with 2,000 monthly authentication events and 2,000 tool calls. Team costs $25 per month plus $0.10 per authentication event and $0.01 per tool call. Enterprise uses annual bundles and custom deployment, governance, and support terms. Model, target-service, and surrounding infrastructure costs remain separate. Reviewed September 10, 2026.

A fair buyer test

Build 30 read and write tasks across three approved services. Seed expired consent, revoked tokens, duplicate requests, prompt injection, ambiguous identities, rate limits, and a partial outage. Measure correct authorization, scope minimization, confirmation quality, duplicate writes, audit completeness, revocation time, p95 latency, and total cost per accepted action. Require direct verification of every consequential write.

Final verdict

Arcade earns a pilot for teams whose agents have outgrown hand-built OAuth and tool wrappers. Start with reversible actions, narrow scopes, explicit confirmations, short-lived sessions, and audited revocation. Do not mistake a large catalog for permission to expose every tool to every agent.

This is a research-based product assessment, not a claim of hands-on long-term testing. Product, pricing, privacy, security, and usage claims were checked against the first-party sources below on September 10, 2026. Verify current terms and run the proposed test with approved data before adoption.