Handler implements four of the eight security schemes in the A2A specification.
| Scheme |
Handler |
|
Scheme |
Handler |
| HTTP Bearer |
yes |
|
HTTP Basic |
no |
| API key |
yes |
|
OAuth2 authorization_code |
no |
| mTLS |
yes |
|
OAuth2 device_code |
no |
OAuth2 client_credentials |
yes |
|
OpenID Connect |
no |
The four in place cover most deployments, so this is lower urgency than the content and method gaps — but each missing one locks out a class of agent.
Where it stands
auth.py defines AuthType with API_KEY, BEARER, MTLS, OAUTH2. Server config parsing lives in servers.py; the TUI Auth tab and CLI server add flags follow from there.
authorization_code and device_code are meaningfully harder than the rest: both need an interactive flow and somewhere to cache the resulting token, which Handler has no concept of yet. Consider splitting those out if this issue gets large.
The work
- HTTP Basic: straightforward, mirrors the bearer path
- OpenID Connect: discovery document plus token acquisition
- OAuth2
authorization_code / device_code: interactive flows and token storage
Acceptance
- Each added scheme is configurable via
server add, the TOML schema, and the TUI Auth tab
server validate reports credential resolution for each
Related: #81 asks for Google Cloud OIDC identity tokens specifically, which overlaps with the OpenID Connect piece.
Part of the A2A v1.0 parity work.
Context: Handler was audited against the A2A v1.0 specification after the v0.2.0 release. Method coverage at the time: service 7/11, CLI 7/11, TUI 4/11 (after #98), MCP 6/11. The four methods missing everywhere are ListTasks, ListTaskPushNotificationConfigs, DeleteTaskPushNotificationConfig, and GetExtendedAgentCard. A deterministic streaming test agent lives outside the repo at ~/code/handler-streaming-agent — it supports ask (input-required), slow (cancellable), and fail, and its card sets capabilities.streaming = true, which ADK does not do by default.
Handler implements four of the eight security schemes in the A2A specification.
authorization_codedevice_codeclient_credentialsThe four in place cover most deployments, so this is lower urgency than the content and method gaps — but each missing one locks out a class of agent.
Where it stands
auth.pydefinesAuthTypewithAPI_KEY,BEARER,MTLS,OAUTH2. Server config parsing lives inservers.py; the TUI Auth tab and CLIserver addflags follow from there.authorization_codeanddevice_codeare meaningfully harder than the rest: both need an interactive flow and somewhere to cache the resulting token, which Handler has no concept of yet. Consider splitting those out if this issue gets large.The work
authorization_code/device_code: interactive flows and token storageAcceptance
server add, the TOML schema, and the TUI Auth tabserver validatereports credential resolution for eachRelated: #81 asks for Google Cloud OIDC identity tokens specifically, which overlaps with the OpenID Connect piece.
Part of the A2A v1.0 parity work.
Context: Handler was audited against the A2A v1.0 specification after the v0.2.0 release. Method coverage at the time: service 7/11, CLI 7/11, TUI 4/11 (after #98), MCP 6/11. The four methods missing everywhere are
ListTasks,ListTaskPushNotificationConfigs,DeleteTaskPushNotificationConfig, andGetExtendedAgentCard. A deterministic streaming test agent lives outside the repo at~/code/handler-streaming-agent— it supportsask(input-required),slow(cancellable), andfail, and its card setscapabilities.streaming = true, which ADK does not do by default.