Module auth 

Server-side authentication interceptors.

These implement ServerInterceptor and reject unauthenticated requests before the handler runs. They read the request’s HTTP headers from the CallContext — which the JSON-RPC, REST, gRPC, and WebSocket bindings all populate — so a single interceptor guards every transport.

Interceptor	Validates	Feature
ApiKeyAuthInterceptor	A configurable header against allowed keys (constant-time)	always
BearerTokenAuthInterceptor	Authorization: Bearer <token> against allowed tokens (constant-time)	always
JwtAuthInterceptor (auth-jwt feature)	A signed JWT (HS256/RS256/ES256), with static or remote (JWKS) keys	auth-jwt

Error mapping

An interceptor rejects a request by returning an A2aError; these return A2aError::unauthenticated, which each binding answers with its own status (ADR 0014, audit N36): HTTP 401 with a WWW-Authenticate challenge on both HTTP bindings (the JSON-RPC body stays -32600), gRPC UNAUTHENTICATED. A custom interceptor refusing an authenticated caller returns A2aError::permission_denied for 403 / PERMISSION_DENIED. The WebSocket binding checks per message after the upgrade, so it has no status to send and answers the body alone. None of these interceptors reveals why a credential was rejected.

Example

use a2a_protocol_server::auth::BearerTokenAuthInterceptor;
use a2a_protocol_server::RequestHandlerBuilder;

let handler = RequestHandlerBuilder::new(Exec)
    .with_interceptor(BearerTokenAuthInterceptor::new(["secret-token-1", "secret-token-2"]))
    .build()
    .unwrap();

Re-exports

pub use jwt::Jwks;

pub use jwt::JwtAuthInterceptor;

pub use jwt::JwtValidator;

Modules

jwt

JWT bearer-token authentication (HS256 / RS256 / ES256).

Structs

ApiKeyAuthInterceptor

Rejects requests whose API-key header is absent or not in the allowed set.

AuthenticatedPrincipal

A resolved authenticated principal, stashed for downstream interceptors.

BearerTokenAuthInterceptor

Rejects requests whose Authorization: Bearer <token> is absent or whose token is not in the allowed set.

Type Aliases

SharedPrincipal

Convenience alias for a shared principal.