Composio vs Nango vs Scalekit: What Changes When Your Agent Goes to Production

The demo passed. The security review didn't.

Here's a story you've probably lived, or will soon.

A team at Brightwater Logistics builds an agent that reads a customer's Xero invoices, checks usage in Amplitude, and drafts renewal outreach in Apollo. They wire it up with an integration platform in a weekend. The demo is great. Sales signs the first enterprise customer.

Then the customer's security team sends a questionnaire, and the questions are different from anything the demo answered:

• Where do our users' tokens live, and are they kept apart from your other customers' tokens?
• Can your agent do anything our users didn't authorize? What stops it?
• Our Snowflake access uses RSA key pairs and our Google Workspace uses domain-wide delegation. Do you support those?
• If something goes wrong, can you show us which agent did what, for which user, under which permission?
• Our data can't leave our cloud. Can this run inside our VPC?

None of those are about whether a connector exists. All of them are about what happens after the agent is connected.

That's the gap this article covers. I'm comparing three platforms teams often weigh at this stage: Composio, Nango and Scalekit. Each one is judged on the questions above.

What each one does well

Before the hard questions, credit where it's due.

Composio has the biggest catalog of the three. Its toolkits page lists 1,742 toolkits. With managed auth, Composio registers the OAuth apps for popular toolkits like GitHub, Gmail and Slack, so you can get to a first tool call without registering anything yourself. Nothing here gets you to a working demo faster.

Nango lets you own the integration code. Its functions are TypeScript you write, version and deploy, and it supports 700+ APIs for auth. You can self-host it: a free version covers auth and the proxy, and the Enterprise version adds tool calls, syncs and the MCP server on your own Kubernetes or in your own cloud account.

Scalekit is built for the stage after the demo. Its docs list 600+ connectors and 30,000+ tools. It's built around per-user connected accounts, scoped tool bundles, and per-call logs, and it can run in your own infrastructure.

The question changed

In 2025, the question was: does a connector exist for the app I need?

In 2026, the question is: what is the agent allowed to do once it's connected?

Connectors are close to a commodity now. All three platforms cover Apollo and Xero, for example. What differs is everything around the connector: who holds the credentials, what stops a bad call, and what you can prove afterwards.

You can build that layer yourself. It's a token vault per user, refresh logic, a proxy that adds tokens at call time, a permission check in front of every tool, a log pipeline, and a deployment you can ship into a customer's cloud. Each piece is a few weeks of work, and every new app and customer adds to it. So the real choice is which platform takes over which pieces, and which ones you keep.

Six questions enterprise customers ask

1. Where do the credentials live, and who else's are next to them?

All three encrypt tokens at rest. The differences are in who holds them and what separates one customer from another.

• Composio stores and refreshes connected-account credentials for you, whether you use its managed OAuth apps or your own. That makes its infrastructure part of your recovery path. Its own disclosure of the May 2026 incident reported leaked connected-account tokens for about 0.3% of active connections, mostly GitHub and Gmail. Composio says its APIs no longer return those tokens. The lesson applies to every vendor in this space: wherever tokens are pooled, that's your blast radius.
• Nango encrypts credentials with AES-256-GCM, with keys wrapped in AWS KMS. Its security page describes isolation at the environment level: each environment has separate credentials, connections and API keys. For production it expects your own OAuth apps.
• Scalekit encrypts every token and API key with a key unique to your environment, wrapped by a master key in Google Cloud KMS that's kept apart from the database (overview). You can bring your own OAuth apps, so consent screens show your brand and rate limits are yours.

None of the three docs describe a separate vault per end customer. If a customer needs that, separate environments or a self-hosted deployment are the way to get it, on any of them.

2. Can the agent do more than the user authorized?

A valid token proves who the user is. It doesn't stop a prompt-injected email from asking the agent to delete a record.

• Composio limits a session to the toolkits you pass, can block tools by hint such as destructiveHint, and can pause a call for the user's approval. Approvals are labeled experimental.
• Nango gives each agent session a toolset with allow and deny lists. Beyond that, authorization is code you write into each integration function. A session's scope is fixed once it's created and lasts up to 15 days by default. The docs also note that turning on the nango_proxy tool lets the agent reach any endpoint of a connected integration.
• Scalekit puts each agent role behind a Virtual MCP server that lists exactly which tools it can call, and you mint a short-lived session token per user before each run. A token minted as read-only can't call write tools. The connected account only holds the scopes the user approved, so the app itself still refuses anything the user can't do.

3. How deep do the connectors go beyond popular apps?

Catalog size is one number. Depth on the apps your customers actually use is another. Here's Apollo, an app sales agents rely on:

• Composio: 67 tools, with API key auth.
• Nango: 26 tools and 6 syncs, and you can write more.
• Scalekit: 75 tools, 2 of them marked destructive, with both OAuth and API key versions of the connector.

All three also have Xero. For Amplitude, Nango and Scalekit list connectors; I didn't find one on Composio's toolkit pages, so check before you rely on it.

4. What about auth that isn't OAuth?

Enterprise systems often don't use OAuth at all. Snowflake recommends RSA key pairs. Google Workspace admins use domain-wide delegation. Data platforms use service accounts.

• Composio lists OAUTH2, API_KEY, BEARER_TOKEN and BASIC as auth schemes in its glossary.
• Nango lists OAuth 2.0, OAuth 1.0a, API keys, basic auth and custom auth, and some integrations have a client-credentials version (Xero, for example).
• Scalekit's connector list includes Snowflake with RSA key pairs, BigQuery with a service account, Google Workspace with domain-wide delegation, and Databricks with client credentials.

If your customer runs Azure AD service accounts, ask each vendor directly. I couldn't confirm that pattern in any of the three docs.

5. Can you prove which agent did what, for which user?

• Composio keeps execution logs for up to a year on every plan. Request arguments and responses are stored by default; zero data retention keeps metadata only.
• Nango keeps logs for 15 days on Nango Cloud, exportable through OpenTelemetry, plus an audit trail kept a year and exportable as CSV.
• Scalekit logs every tool call with the agent, tool, user, duration and result, and marks failures as connector or API errors. It records metadata, not content. Logs are kept 30 days on Free and Growth; longer retention and SIEM streaming are Enterprise features.

6. Can it run where the customer's data has to stay?

• Composio lists self-hosting as an enterprise feature.
• Nango offers free self-hosting for auth and the proxy, and Enterprise BYOC or self-managed deployments on AWS, GCP, Azure or on-prem Kubernetes with the full feature set.
• Scalekit runs self-hosted on your Kubernetes cluster with an enterprise license, and its docs list air-gapped environments as a reason to do it. The managed service has separate US and EU deployments.

Side by side

Want the same comparison on video? Here's Scalekit's walkthrough of Composio vs Scalekit:

Which one fits your stage

There's no single winner here. It depends on where you are.

• You need a working demo this week: Composio. The catalog is huge and managed auth gets you to a first tool call quickly.
• You want to write and own every integration: Nango. The code is yours, and you can self-host it.
• You're shipping to enterprise customers: Scalekit. Scoped tools per agent role, a session per user, auth beyond OAuth, per-call logs, and a self-hosted option are the things their security reviews ask about.

Teams also move between stages. If you started on Composio and the security questions are arriving now, Scalekit has a migration guide. One thing to plan for: OAuth refresh tokens are tied to the OAuth client that issued them, so each user connects once more after the move.

When you don't need any of them

If your agent runs for one person, on that person's own API keys, against two or three apps, you don't need an integration platform yet. Keep the keys in environment variables and ship. The calculation changes when the second customer connects their own accounts, or when the first security questionnaire arrives.

Voice agents raise the stakes again: there's no screen for an OAuth consent mid-call, and every extra tool slows the spoken reply. Give Your Voice Agent Hands walks through a sales voice agent that updates HubSpot, Apollo, Google Calendar and Gmail after a call.

Getting started

To try per-user tool calls with your own accounts, start with the Scalekit quickstart.