Module auth 

Server-side authentication interceptors.

These implement ServerInterceptor and reject unauthenticated requests before the handler runs. They read the request’s HTTP headers from the CallContext — which the JSON-RPC, REST, gRPC, and WebSocket bindings all populate — so a single interceptor guards every transport.

Interceptor	Validates	Feature
ApiKeyAuthInterceptor	A configurable header against allowed keys (constant-time)	always
BearerTokenAuthInterceptor	Authorization: Bearer <token> against allowed tokens (constant-time)	always
JwtAuthInterceptor (auth-jwt feature)	A signed JWT (HS256/RS256/ES256), with static or remote (JWKS) keys	auth-jwt

Error mapping

An interceptor rejects a request by returning an A2aError. The A2A protocol has no dedicated “unauthenticated” error code (the spec models authentication at the transport/security-scheme layer, e.g. an HTTP 401 with WWW-Authenticate), so a rejection surfaces as InvalidRequest (HTTP 400 / gRPC INVALID_ARGUMENT). When you need true 401 semantics with a challenge header, terminate authentication at a gateway in front of the agent; these interceptors are the self-contained, defense-in-depth option and never reveal why a credential was rejected to the caller.

Example

use a2a_protocol_server::auth::BearerTokenAuthInterceptor;
use a2a_protocol_server::RequestHandlerBuilder;

let handler = RequestHandlerBuilder::new(Exec)
    .with_interceptor(BearerTokenAuthInterceptor::new(["secret-token-1", "secret-token-2"]))
    .build()
    .unwrap();

Modules

jwt

JWT bearer-token authentication (HS256 / RS256 / ES256).

Structs

ApiKeyAuthInterceptor

Rejects requests whose API-key header is absent or not in the allowed set.

AuthenticatedPrincipal

A resolved authenticated principal, stashed for downstream interceptors.

BearerTokenAuthInterceptor

Rejects requests whose Authorization: Bearer <token> is absent or whose token is not in the allowed set.

Jwks

A set of asymmetric verification keys (an RFC 7517 JWK Set).

JwtAuthInterceptor

A ServerInterceptor that authenticates requests with a signed JWT.

JwtValidator

The set of claim checks applied after a JWT’s signature verifies.

Type Aliases

SharedPrincipal

Convenience alias for a shared principal.