Skip to content
Agent Identity

Flow · agent-as-resource

Agent as resource (others call it)

Your agent exposes an HTTP API or A2A skill. Callers authenticate using whatever the Agent Card or Protected Resource Metadata advertises.

Actors

Calling agent · Your agent (RS) · Optional AS

Sequence

  1. 1

    Calling agent→Your agent

    Fetches Agent Card or RFC 9728 metadata

  2. 2

    Calling agent→AS or your agent

    Obtains credentials: OAuth client credentials, mTLS, AAuth identity-based, or API key (last resort)

  3. 3

    Calling agent→Your agent

    Authenticated task/API request (A2A-Version or signed HTTP)

Caveats

A2A signed Agent Cards prove the card was not tampered with; they do not authenticate the request. Still require a request-level scheme.

Specs in play