The A2A server never sees the client secret. The client exchanges client_credentials out of band and sends Authorization: Bearer on the HTTP request. The JSON-RPC body stays the message.
The exchange itself is in Agent frameworks. This page is where that secret is allowed to live.
Which credential
| Credential | Use it when |
|---|---|
| Agent identity | A named agent inside an existing project. You want verify, revoke, allowed tools, and activity. The Agents module is sales-gated until access is approved. |
| M2M application | The caller is a backend, job, or CI workload, and Agents access is not approved yet. Same client_credentials grant. |
| Personal access token | One person's local script. Keep it off the unattended A2A client. |
| Service account | Organization-owned automation through the Authdog REST API, not this agent card. |
Create the agent or the M2M application in the console and copy the client id and client secret. The secret is shown once.
Where each value goes
| Variable | Process | Purpose |
|---|---|---|
AUTHDOG_CLIENT_ID / AUTHDOG_CLIENT_SECRET |
A2A client | HTTP basic auth on the token endpoint. |
AUTHDOG_TOKEN_URL |
Client and server | Discovery on the card, and the URL the client calls. |
PK_AUTHDOG |
Server | Public key. Selects the identity host for require_auth. |
| Access token | HTTP Authorization header |
What the gate checks. Mint again before expires_in. |
There is no refresh token. The sample client performs one exchange per run. The same HTTP client can fetch the public card and send the message, so the bearer rides on both. Card fetch succeeds without a token. Message calls do not.
PK_AUTHDOG does not mint tokens. A vault secret or an API key stored for something else is not this bearer. The gate calls userinfo with the access token from the exchange.
Acting for a person
Keep the same gate. Replace the client_credentials access token with an RFC 8693 token. sub stays the user. act names the agent. Grant token exchange on the agent in Agents.
Related
| Read | To learn how to |
|---|---|
| Custom channel auth for A2A | See why the card is public and the mount is not |
| Machine identity | Compare M2M, Agents, service account, and PAT |
| Agents quickstart | Register the client that mints the token |
| A2A | Run the client that performs the exchange |