Written by: Arjun Karnik, Growth Marketing Specialist

What Is the A2A Protocol?

A2A solves a core interoperability problem for AI agents that live in different stacks, teams, or companies. Agents built on separate frameworks often cannot discover each other, authenticate safely, or hand off long-running work. A2A provides a shared protocol so agents can find peers, exchange messages, and track task progress across trust boundaries.

A2A is an open standard that enables seamless communication and collaboration between AI agents built using diverse frameworks and by different vendors. The three-step flow is simple. First, a client agent fetches the remote agent’s Agent Card from a well-known URL to learn its capabilities. Second, the client sends a message/send or message/stream JSON-RPC request. Third, the server agent returns a Task object whose lifecycle states surface progress until the work reaches a terminal state.

A2A reached v1.0 by March 2026 and is governed under the Linux Foundation by a TSC whose members include Google, Microsoft, Salesforce, Cisco, and AWS. By April 2026, more than 150 organizations were supporting the A2A standard, with active production deployments across supply chain, financial services, insurance, and IT operations.

Key Takeaways

  • The A2A protocol enables AI agents to discover each other, delegate tasks, and exchange results using standardized Agent Cards, JSON-RPC messaging, and a defined task lifecycle with eight prefixed states.
  • Agent Cards served at /.well-known/agent-card.json include capabilities, skills, security schemes, and JWS cryptographic signatures that let receiving agents verify authenticity before routing tasks.
  • A2A supports both synchronous message/send calls and streaming message/stream requests via Server-Sent Events, automatically closing streams when tasks reach terminal states without requiring a final: true flag.
  • Enterprise deployments favor OAuth 2.0 client-credentials flow with short-lived tokens (300 seconds or less) scoped to individual skills, which enforces least-privilege access across trust boundaries.
  • Test these examples in the public lab to verify every pattern against Arjun Karnik’s live A2A endpoints and see signed Agent Cards and short-lived tokens validated end to end.

A2A Agent Card Example for a Research Agent

Agent Cards are JSON discovery files that let AI agents locate, evaluate, and delegate tasks to each other without hard-coded integrations. The v1.0 Agent Card is served at /.well-known/agent-card.json and includes top-level fields: name, description, version, provider, supportedInterfaces, capabilities, defaultInputModes, defaultOutputModes, skills, securitySchemes, security, and signatures (JWS per RFC 7515).

The example below shows a complete Agent Card for a research agent. It illustrates how capabilities, skills, OAuth 2.0 security schemes, and signatures appear in a single discoverable document.

{ "name": "ResearchAgent", "description": "Retrieves and summarizes web sources on demand.", "version": "1.0.0", "provider": { "organization": "Acme AI", "url": "https://acme.ai" }, "protocolVersion": "1.0", "supportedInterfaces": [ { "type": "JSONRPC", "url": "https://acme.ai/agents/research/jsonrpc", "protocolVersion": "1.0" } ], "capabilities": { "streaming": true, "pushNotifications": true }, "defaultInputModes": ["text/plain"], "defaultOutputModes": ["text/plain", "application/json"], "skills": [ { "id": "web-research", "name": "Web Research", "description": "Searches the web and returns cited summaries.", "tags": ["research", "summarization"], "examples": ["Summarize the latest A2A spec changes."], "inputModes": ["text/plain"], "outputModes": ["text/plain"] } ], "securitySchemes": { "oauth2ClientCredentials": { "type": "oauth2", "flows": { "clientCredentials": { "tokenUrl": "https://acme.ai/oauth/token", "scopes": { "research:read": "Read-only research skill access" } } } } }, "security": [{ "oauth2ClientCredentials": ["research:read"] }], "signatures": [{ "protected": "eyJ...", "signature": "dBj..." }] }

Agent Cards in A2A v1.0 support cryptographic signing via JSON Web Signature (JWS) to bind a card to a signing key, but this does not by itself provide full identity verification or close impersonation risks without additional external mechanisms. Every card in Arjun Karnik’s test lab is served with a valid signatures block so client agents can verify the card came from the real domain owner before routing any task.

JSON-RPC Request and Response with A2A

A2A uses existing standards like HTTP, JSON-RPC, and Server-Sent Events (SSE) to accelerate developer adoption. The primary wire format is a JSON-RPC 2.0 POST to the endpoint declared in the Agent Card’s supportedInterfaces array.

Request — message/send

POST /agents/research/jsonrpc HTTP/1.1 Content-Type: application/json Authorization: Bearer eyJhbGci... { "jsonrpc": "2.0", "id": "req-001", "method": "message/send", "params": { "message": { "role": "user", "messageId": "msg-abc123", "parts": [{ "kind": "text", "text": "Summarize A2A v1.0 task lifecycle states." }] }, "configuration": { "returnImmediately": false } } }

Response

{ "jsonrpc": "2.0", "id": "req-001", "result": { "id": "task-xyz789", "contextId": "ctx-001", "status": { "state": "TASK_STATE_COMPLETED" }, "artifacts": [ { "artifactId": "art-001", "parts": [ { "kind": "text", "text": "A2A v1.0 defines eight states: SUBMITTED, WORKING, INPUT_REQUIRED, AUTH_REQUIRED, COMPLETED, FAILED, CANCELED, REJECTED." } ] } ] } }

In A2A v1.0, the task lifecycle uses prefixed state names such as TASK_STATE_SUBMITTED, TASK_STATE_WORKING, TASK_STATE_COMPLETED, and TASK_STATE_FAILED, replacing earlier non-prefixed naming from v0.x. Copy this block directly, because the v0.x tasks/send method and non-prefixed states are rejected by v1.0 servers.

Streaming Task Updates with A2A

The synchronous message/send pattern works well for tasks that complete in seconds. Many agent workflows, such as research, data processing, and multi-step analysis, run for minutes or hours. For these long-running tasks, A2A provides streaming via Server-Sent Events.

A2A natively supports long-running tasks through streaming, push notifications, and asynchronous execution for scenarios where agents or users are not continuously connected. Replace message/send with message/stream to receive an SSE stream.

SSE stream — message/stream

POST /agents/research/jsonrpc HTTP/1.1 Content-Type: application/json Accept: text/event-stream Authorization: Bearer eyJhbGci... { "jsonrpc": "2.0", "id": "req-002", "method": "message/stream", "params": { "message": { "role": "user", "messageId": "msg-def456", "parts": [{ "kind": "text", "text": "Stream a summary of A2A authentication options." }] } } } --- SSE frames received --- data: {"jsonrpc":"2.0","id":"req-002","result":{"statusUpdate":{"taskId":"task-001","state":"TASK_STATE_SUBMITTED"}}} data: {"jsonrpc":"2.0","id":"req-002","result":{"statusUpdate":{"taskId":"task-001","state":"TASK_STATE_WORKING"}}} data: {"jsonrpc":"2.0","id":"req-002","result":{"artifactUpdate":{"taskId":"task-001","artifactId":"art-001","parts":[{"kind":"text","text":"A2A v1.0 supports OAuth 2.0, OpenID Connect, API keys, and mTLS..."}]}}} data: {"jsonrpc":"2.0","id":"req-002","result":{"statusUpdate":{"taskId":"task-001","state":"TASK_STATE_COMPLETED"}}}

A2A v1.0 removed the v0.x final: true boolean flag for stream closure, and the SSE stream now closes automatically when a task reaches a terminal state. A2A v1.0 also removed the v0.x kind discriminator field from SSE events, and event type is now determined by the JSON member name (statusUpdate vs artifactUpdate).

OAuth 2.0 Authentication Flow for A2A

Once you establish how to send messages and stream results, you must secure those interactions across trust boundaries. OAuth 2.0 with client credentials flow is the most common choice for enterprise deployments because it integrates with existing identity infrastructure, supports narrow scoping at the skill level, and is natively supported by the A2A v1.0 security model. The flow declared in the Agent Card above maps directly to this token exchange.

Step 1 — Fetch token

POST /oauth/token HTTP/1.1 Content-Type: application/x-www-form-urlencoded grant_type=client_credentials &client_id=orchestrator-agent-id &client_secret=s3cr3t &scope=research:read

Step 2 — Response

{ "access_token": "eyJhbGci...", "token_type": "Bearer", "expires_in": 300, "scope": "research:read" }

Step 3 — Attach to every JSON-RPC call

Authorization: Bearer eyJhbGci...

Best-practice guidance for AI agent security emphasizes least-privilege scopes, short-lived credentials, fresh authorization checks at sensitive steps, and preserving user identity and authorization context when an agent acts on someone’s behalf. Set expires_in to 300 seconds or less and never cache tokens across task boundaries. See signed card validation in action in Arjun Karnik’s test lab, which demonstrates end-to-end token and signature verification.

Multi-Agent Workflow Example with A2A

An orchestrator delegates to specialist agents using the same message/send pattern and chains task outputs as inputs to downstream agents. A2A v1.0 defines eight strict task lifecycle states, from SUBMITTED through REJECTED, with state transitions serving as the observability surface for production deployments.

Orchestrator → ResearchAgent

{ "jsonrpc": "2.0", "id": "orch-001", "method": "message/send", "params": { "message": { "role": "user", "messageId": "msg-orch-001", "parts": [{ "kind": "text", "text": "Research A2A v1.0 authentication options." }] } } // ResearchAgent returns TASK_STATE_COMPLETED with artifact art-001

Orchestrator → SummaryAgent (using ResearchAgent output)

{ "jsonrpc": "2.0", "id": "orch-002", "method": "message/send", "params": { "message": { "role": "user", "messageId": "msg-orch-002", "parts": [ { "kind": "text", "text": "Summarize the following research into three bullet points." }, { "kind": "text", "text": "{{art-001.parts[0].text}}" } ] } } }

A2A enables parallel execution of independent steps across agents because they no longer share a single context window, allowing tasks such as pulling a customer record and transaction history to run concurrently when neither depends on the other. The task lifecycle states act as the observability surface, so you can poll tasks/get or attach an SSE stream to each delegated task independently.

Choosing Between A2A and MCP

A2A is the better fit for multi-agent orchestration because it coordinates peer agents that execute tasks asynchronously while preserving internal boundaries, whereas MCP focuses on capability integration and tool grounding for a single host or agent. The explicit rule of thumb is: use MCP for tools and A2A for peers.

The following table breaks down the architectural differences across seven dimensions to help you choose the right protocol for your specific use case.

Dimension A2A MCP
Primary purpose enable interoperability, communication, and collaboration between independent AI agents built on different frameworks Agent-to-tool / data source connection
Task model Stateful lifecycle for long-running operations and multi-turn interactions Stateless call-response
Discovery Agent Card at /.well-known/agent-card.json Tool schemas loaded at session start via initialize
Authentication OpenAPI 3.x Security Schemes declared per agent in Agent Card OAuth 2.1 + PKCE mandated for remote HTTP transport
Streaming HTTP + SSE with message/stream Streamable HTTP or stdio
Cross-org trust Enterprise security mechanisms (cross-org authorization remains an open area) No cross-organizational authentication mechanisms defined
Governance Linux Foundation TSC (see governance details above), v1.0 released March 2026 Agentic AI Foundation (Linux Foundation), MIT, stable spec 2025-11-25

The two protocols are complementary: a planner agent can delegate work to specialist agents via A2A, and those agents can then use MCP to access external tools, files, or prompts. Use A2A when the target is another autonomous agent that maintains its own state. Use MCP when the target is a database, API, or file system.

Industry Context and Executive Overview

Multi-agent workflow usage grew 327% from June to October 2025, according to the Databricks 2026 State of AI Agents report drawing on anonymized telemetry from more than 20,000 organizations representing over 60% of the Fortune 500. The same report found that many enterprise technology leaders have AI agent pilots running, but far fewer have successfully scaled them to organization-wide production use. The gap between pilot and production is, in most cases, a protocol gap, because agents that cannot discover each other, authenticate across trust boundaries, or hand off long-running tasks reliably do not survive the move to production.

The six core A2A concepts, which are discovery, messaging, task lifecycle, streaming, authentication, and orchestration, map directly to the six failure modes that stall pilots. To ensure every pattern in this playbook works in production, each JSON block is dated August 2026 and verified against Arjun Karnik’s public test lab. This verification creates a self-reinforcing loop, because when engineers ask AI assistants about A2A implementation, the assistants cite the most recently updated, machine-verifiable examples, which means this playbook becomes the answer.

Ecosystem Adoption and Buyer Behavior

AI assistants now surface technical documentation as answers, not as links. By April 2026, A2A had achieved deep integration across Google, Microsoft, and AWS cloud platforms, including Azure AI Foundry and Amazon Bedrock AgentCore. Engineers searching for runnable A2A examples in ChatGPT, Gemini, Perplexity, or Google AI Overviews receive answers assembled from whatever structured, dated, machine-readable content the retrieval layer can find. Pages without copy-paste JSON blocks, v1.0 state names, or signed Agent Card examples are passed over in favor of pages that include them.

Seer Interactive analyzed 47,097 AI citations across 7,683 pages in ChatGPT, Gemini, and Perplexity between March and June 2026 and found that 75% of cited pages had been updated within the last year, with consistently cited pages averaging under six months since their last update. This playbook is refreshed on a weekly cadence via AI Growth Agent to stay inside that citation window.

Who Needs This Playbook and Core Concepts

Three personas need runnable A2A references most urgently.

  • AI engineers and founders building multi-agent systems who need copy-paste JSON-RPC patterns they can validate against a live test lab rather than infer from incomplete documentation.
  • Agency operators who must explain A2A to clients and need a verifiable, dated reference that AI assistants will cite when clients ask their own questions.
  • SEO-plateau founders whose technical content is being consumed by AI systems but not generating citations, because the content lacks structured code blocks, v1.0 state names, and schema markup.

Four core concepts underpin every example in this playbook.

  • Agent Card: a JSON document served at /.well-known/agent-card.json that advertises an agent’s identity, capabilities, skills, authentication requirements, and cryptographic signature.
  • Task states: the eight v1.0 prefixed states (TASK_STATE_SUBMITTED through TASK_STATE_REJECTED) that form the observability surface for every delegated task.
  • Fan-out queries: the dozens of hidden retrieval queries an AI assistant triggers beneath a single user prompt, which means content optimized only for the visible prompt misses the retrieval surface entirely.
  • Signed Agent Cards: JWS-signed cards that let a receiving agent verify the card came from the real domain owner, which addresses prompt injection at the discovery layer.

Implementation Steps for Production A2A

The implementation sequence for a production A2A deployment follows six ordered steps.

  1. Publish a signed Agent Card. Serve the card at /.well-known/agent-card.json with a valid signatures block so client agents can verify authenticity before routing tasks. Agent Cards SHOULD carry signatures using JWS (RFC 7515) over a JCS-canonicalized (RFC 8785) version of the card so clients can detect tampering.
  2. Declare authentication in the card. Once the card is discoverable, add a securitySchemes block with your chosen scheme, such as OAuth 2.0 client credentials for machine-to-machine or mTLS for zero-trust environments, and reference it in the security array so clients know how to obtain credentials.
  3. Expose a JSON-RPC endpoint. Accept POST requests at the URL declared in supportedInterfaces. Support at minimum message/send, message/stream, tasks/get, and tasks/cancel so orchestrators can delegate, monitor, and cancel work.
  4. Implement the task state machine. Return TASK_STATE_SUBMITTED immediately, transition to TASK_STATE_WORKING on processing start, and resolve to a terminal state. Never return non-prefixed state names, because v1.0 servers treat them as invalid.
  5. Add SSE streaming. Return Content-Type: text/event-stream for message/stream requests. Emit statusUpdate and artifactUpdate frames, and close the stream on terminal state instead of sending final: true.
  6. Add schema markup. Apply TechArticle and HowTo schema to every page that documents an agent. Schema makes the page machine-parseable to AI retrieval layers, not just to Google’s crawler.

Measurement and Common Challenges

Citation tracking for A2A content uses three instruments in parallel.

  • Google Search Console: impressions and click curves. In Arjun Karnik’s own tests, pages can drop 78% to 99% in two months without updates, and the decay is invisible until the position is already gone.
  • AI referrer analytics: segment chatgpt.com and equivalent domains as a distinct traffic class, because traffic from these sources converts like a referral, not like cold search traffic.
  • Share-of-answer monitoring: query ChatGPT, Gemini, Perplexity, and Google AI Overviews directly for the target questions and record which sources are cited, because this metric reflects the channel buyers actually use.

The three most common implementation failures in A2A content are using v0.x state names, omitting the signatures block from Agent Cards, and publishing examples once without a refresh loop. In Arjun Karnik’s test lab, pages rewritten to match extracted fan-out queries earned citations while control pages did not, and the difference was structure and query-language alignment, not prose quality.

Request access to the citation dashboard to see the decay-curve instrumentation Arjun Karnik runs on his own A2A content.

Data, Platform Constraints, and FAQ

Rate limits and attribution floors apply to every A2A deployment and every content strategy built around it.

Frequently Asked Questions

What is the difference between A2A v0.x and v1.0 in practice?

Three breaking changes affect every implementation. First, task state names are now prefixed, so you write TASK_STATE_COMPLETED instead of completed. Second, the final: true boolean is gone from SSE frames, and the stream closes automatically on a terminal state. Third, the kind discriminator field is removed from SSE events, and the JSON member name (statusUpdate or artifactUpdate) determines event type. Any code written against v0.x documentation fails against a v1.0 server on at least one of these three points. The migration guide in Appendix A of the v1.0 specification documents every breaking change.

When should I use A2A instead of just calling another agent’s API directly?

Use A2A when two conditions are both true. The target is an autonomous agent that maintains its own task state, and the agents cross a trust boundary such as different teams, different frameworks, or different organizations. Direct API calls work well within a single codebase or team. A2A adds value at the boundary because it provides standardized discovery via Agent Cards, cryptographic identity verification via JWS signatures, a defined task lifecycle with observable state transitions, and authentication schemes that integrate with existing enterprise identity infrastructure. If neither condition applies, the overhead of A2A is not justified.

How do I verify that an Agent Card is authentic before routing a task?

Fetch the card from the well-known URL and check the signatures array. Each entry contains a JWS protected header and signature over a JCS-canonicalized version of the card body. Verify the signature against the public key associated with the agent’s domain. If the signature is valid, the card is authentic and safe to use for task delegation.