Skip to main content
Get started
A2ASignature status
A2A

Signature status

Verify which agent sent a task and keep identity stable across the whole conversation.

Current A2A signing status: use OAuth/API keys for A2A, and UCP signed intents for signed checkout calls.

A2A and UCP share bearer-token authentication, but they do not share the same signing behavior today. The live A2A route authenticates callers with OAuth access tokens or API keys; it does not currently validate Request-Signature headers or sign A2A responses.

Current state
Do not require A2A Response-Signature, JWKS-Url, per-task signing identity, or signing.request_signature_requiredfrom Aly's A2A responses. Those fields are not emitted by the current A2A route or agent-card builders.

What to use for A2A auth

Use a workspace-scoped bearer token. Public read-styleSendMessage skills can run without auth, but cart, checkout, task lookup, listing, cancelation, subscriptions, and push config management require OAuth or API-key auth.

http
POST /api/a2a HTTP/1.1Host: aly.storeContent-Type: application/jsonA2A-Version: 1.0Authorization: Bearer aly_oauth_... {  "jsonrpc": "2.0",  "id": "req_1",  "method": "SendMessage",  "params": {    "message": {      "messageId": "msg_1",      "role": "ROLE_USER",      "parts": [        {          "mediaType": "application/json",          "data": {            "skill": "cart-management",            "action": "create",            "site_slug": "acme"          }        }      ]    }  }}

Where signing exists today

UCP checkout routes do support optional, non-blocking request-signature validation and signed responses. If an A2A task returns a UCP checkout complete_url, sign that UCP request when you need cryptographic agent identity on the checkout step. See Signed intents.

Agent card signatures

Aly's A2A type model has room for agent-card signatures, but the current platform and store cards do not emit a signed card or JWKS pointer. Discover capabilities from supportedInterfaces,capabilities, securitySchemes, and skills.

Recommended client behavior

  1. Use HTTPS and fetch /.well-known/agent-card.json from the store host.
  2. Use the card's supportedInterfaces URL for A2A calls.
  3. Send Authorization: Bearer aly_oauth_... or Authorization: Bearer aly_... for authenticated skills and task routes.
  4. Do not block on missing A2A response signatures.
  5. Apply UCP request signing only when calling UCP routes that document signed-intent support.
Updated

Was this page helpful?