Skip to main content
Agent Identity

Flow · agent-as-resource

Agent as resource (others call it)

Your agent exposes an HTTP API or A2A skill. Callers authenticate using whatever the Agent Card or Protected Resource Metadata advertises.

Use the hop list beside the stage, or the phase labels, to jump. Every hop has Now, Why, the RFC, and chips — none are skipped.

Actors

Calling agent · Your agent (RS) · Optional AS

Sequence

Animated sequence · agent-as-resource

A2A / PRM — How do callers authenticate to an agent that exposes an API or skill?

Agent as resource (others call it)

Your agent exposes an HTTP API or A2A skill. Callers authenticate using whatever the Agent Card or Protected Resource Metadata advertises.

Calling agentsends
Your agent (RS)gets
Optional AS

Now · 1/4· Discover· RFC 9728You are here

Calling agent→Your agent (RS)·Fetches Agent Card (A2A) or RFC 9728 protected resource metadata

GET Agent Card (A2A) or PRM (OAuth resource). If both exist, read both — they are different catalogs.

Why The catalog declares how to authenticate. It does not authenticate the request. Do not skip the card or the PRM document.

Read the catalog on the door before asking for a pass.

  • Agent Card from the spec
  • securitySchemes from the spec
  • PRM from the spec

Solid = from the spec

Step 1 of 4: calling-agent to your-agent-rs. Fetches Agent Card (A2A) or RFC 9728 protected resource metadata RFC 9728
Speed
ShareLinkedInX

A2A signed Agent Cards prove the card was not tampered with; they do not authenticate the request. Still require a request-level scheme.

Transcript

  1. 1

    DiscoverCalling agent→Your agent (RS)RFC 9728

    Fetches Agent Card (A2A) or RFC 9728 protected resource metadata

    GET Agent Card (A2A) or PRM (OAuth resource). If both exist, read both — they are different catalogs.

    Why The catalog declares how to authenticate. It does not authenticate the request. Do not skip the card or the PRM document.

    Read the catalog on the door before asking for a pass.

    • Agent Card
    • securitySchemes
    • PRM
  2. 2

    DiscoverCalling agent→Calling agentA2A v1.0

    Reads securitySchemes (or authorization_servers) and the advertised endpoint

    securitySchemes / authorization_servers tell the caller what to obtain out of band. url (A2A) or the resource identifier (PRM) is where the later call goes.

    Why Do not skip this read. Calling a guessed URL without reading the catalog is not the flow.

    Read the menu: which pass, which kitchen.

    • securitySchemes
    • url
    • authorization_servers
  3. 3

    GrantCalling agent→Optional ASOAuth 2.1

    Obtains credentials: OAuth client credentials, mTLS, AAuth identity-based, or API key (last resort)

    Out of band. If the card says OAuth, talk to an AS (full code+PKCE is the OAuth 2.1 sequence). If you choose AAuth, that is signed HTTP — a different scheme.

    Why Optional if the card named mTLS or AAuth instead of OAuth. A2A does not invent a p2p login. Implicit and password grants are the wrong answer.

    Go to the desk the catalog named — or seal the envelope if AAuth is what it asked.

    • client credentials
    • mTLS
    • aa-agent+jwt
  4. 4

    CallCalling agent→Your agent (RS)A2A v1.0

    HTTP to the advertised endpoint: authenticated task/API request

    Present whatever the catalog asked for (A2A-Version or signed HTTP). Do not confuse A2A tasks with AAuth identity-based p2p.

    Why A signed Agent Card is not a request credential. Still require a request-level scheme. Call the url the catalog named.

    Place the order with the pass the menu asked for.

    • A2A-Version
    • Authorization
    • Signature-Key

Caveats

A2A signed Agent Cards prove the card was not tampered with; they do not authenticate the request. Still require a request-level scheme.

Deployment patterns

Specs in play