# Connect Agents with A2A

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [agentic-data-plane-full.txt](https://docs.redpanda.com/agentic-data-plane-full.txt)

---
title: Connect Agents with A2A
latest-operator-version: v26.1.5
latest-console-tag: v3.7.4
latest-connect-version: 4.96.1
latest-redpanda-tag: v26.1.10
docname: a2a-concepts
page-component-name: agentic-data-plane
page-version: master
page-component-version: master
page-component-title: Agentic Data Plane
page-relative-src-path: a2a-concepts.adoc
page-edit-url: https://github.com/redpanda-data/adp-docs/edit/main/modules/connect/pages/a2a-concepts.adoc
description: The A2A protocol enables agents to discover and call each other across platforms. Learn how agent cards, authentication, and protocol versioning work in ADP.
page-topic-type: concepts
personas: agent_builder
learning-objective-1: Describe the A2A protocol and its role in agent communication
learning-objective-2: Explain how agent cards enable discovery
learning-objective-3: Identify how authentication secures agent communication
page-git-created-date: "2026-05-28"
page-git-modified-date: "2026-06-10"
---

<!-- Source: https://docs.redpanda.com/agentic-data-plane/connect/a2a-concepts.md -->

The Agent-to-Agent (A2A) protocol is an open standard that defines how agents discover, communicate with, and call each other across platforms. Each A2A-compliant agent exposes a machine-readable agent card at a well-known URL, describing its capabilities and how to authenticate with it. Callers fetch the card at runtime, so they reach any A2A agent without prior knowledge of its implementation, and agents can update their capabilities without breaking existing callers.

In Redpanda ADP, A2A enables two integration paths: external applications and agents calling ADP agents over HTTP, and Redpanda Connect pipelines invoking agents for each event in a stream.

After reading this page, you will be able to:

-   Describe the A2A protocol and its role in agent communication

-   Explain how agent cards enable discovery

-   Identify how authentication secures agent communication


## [](#what-is-the-a2a-protocol)What is the A2A protocol?

The Agent-to-Agent (A2A) protocol is an open standard that defines how agents discover, communicate with, and invoke each other.

Agents that implement A2A expose their capabilities through a standardized agent card. This allows other systems to interact with them without prior knowledge of their implementation.

The protocol provides:

-   Standardized discovery: Agent cards describe capabilities in a machine-readable format.

-   Platform independence: Any system can call any A2A-compliant agent.

-   Version negotiation: Protocol versions ensure compatibility between agents.

-   Communication mode flexibility: Supports synchronous request/response and streaming.


For the complete specification, see [a2a.ag/spec](https://a2a.ag/spec).

## [](#agent-cards)Agent cards

Every A2A-compliant agent exposes an agent card at a well-known URL.

The agent card is a JSON document that describes what the agent can do and how to interact with it. For the complete agent card specification, see [Agent Card documentation](https://agent2agent.info/docs/concepts/agentcard/).

### [](#agent-card-location)Agent card location

ADP agents expose their agent cards at the `/.well-known/agent-card.json` subpath of the agent URL. You can find the agent URL on the **Agents** page.

For example, if your agent URL is `https://my-agent.ai-agents.abc123.cloud.redpanda.com`, your agent card URL is `https://my-agent.ai-agents.abc123.cloud.redpanda.com/.well-known/agent-card.json`.

The `.well-known` path follows internet standards for service discovery, making agents discoverable without configuration.

The agent card is served without authentication. The A2A protocol requires the discovery card to be publicly reachable, because a caller fetches it to learn how to authenticate with the agent. Invoking the agent still requires authentication. For details, see the [Authentication](#authentication) section.

To configure the agent card, see [Configure A2A discovery metadata](https://docs.redpanda.com/agentic-data-plane/connect/create-agent/#configure-a2a-discovery-metadata-optional).

## [](#where-a2a-is-used-in-adp)Where A2A is used in ADP

ADP uses the A2A protocol in two contexts:

### [](#external-integration)External integration

External applications and agents hosted outside ADP use A2A to call ADP agents. This includes backend services, CLI tools, custom UIs, and agents hosted on other platforms.

For integration pattern guidance, see [Choose an Integration Pattern](https://docs.redpanda.com/agentic-data-plane/connect/integration-overview/).

### [](#internal-pipeline-to-agent-integration)Internal pipeline-to-agent integration

Redpanda Connect pipelines use the [`a2a_message`](https://docs.redpanda.com/cloud-data-platform/develop/connect/components/processors/a2a_message/) processor to invoke agents for each event in a stream. This enables real-time interaction between streaming data and AI agents, enabling use cases like:

-   Real-time fraud detection on every transaction.

-   Streaming data enrichment with AI-generated fields.

-   Event-driven agent invocation for automated processing.


The `a2a_message` processor uses the A2A protocol internally to discover and call agents. For pipeline patterns, see [Integrate with Redpanda Pipelines](https://docs.redpanda.com/agentic-data-plane/connect/pipeline-integration-patterns/).

## [](#how-agents-discover-each-other)How agents discover each other

A2A enables dynamic discovery without hardcoded configuration:

1.  The caller fetches the agent card from the well-known URL.

2.  The caller checks the protocol version and supported communication modes.

3.  The caller uses the input schema from the agent card to format the request properly.

4.  The caller sends the request to the agent’s endpoint.


This discovery model allows:

-   New agents to become available immediately after deployment

-   Existing agents to update their capabilities while callers adapt dynamically

-   Callers to understand exactly what agents do through self-describing agent cards


## [](#authentication)Authentication

A2A-compliant agents require authentication to prevent unauthorized access.

The agent card is the exception. ADP serves the card at the `/.well-known/agent-card.json` subpath without authentication, so that callers can discover how to authenticate before they hold a token. Every other request to the agent, including agent invocation, requires a valid access token.

ADP agents use OAuth2 client credentials flow. When you create an agent, the system provisions a service account with a client ID and secret.

External callers use these credentials to obtain access tokens:

1.  Agent creation automatically provisions a service account with credentials.

2.  Applications exchange the client ID and secret for a time-limited access token through OAuth2.

3.  Applications include the access token in the Authorization header when calling the agent endpoint.

4.  When tokens expire, applications exchange credentials again for a new token.


This flow ensures:

-   Credentials stay secure: Applications never send them directly to agents, only access tokens.

-   Exposure is limited: Tokens expire, reducing the window for compromised credentials.

-   Integration is standard: Applications can use existing OAuth2 libraries.


### [](#external-integration-2)External integration

External applications must authenticate using the service account credentials. Each agent has its own service account.

For step-by-step authentication instructions, see [Authentication](https://docs.redpanda.com/cloud-data-platform/security/cloud-authentication/).

### [](#internal-integration)Internal integration

The `a2a_message` processor handles authentication automatically. Pipelines don’t need to manage credentials explicitly because they run within ADP with appropriate permissions.

## [](#protocol-versions)Protocol versions

The A2A protocol uses semantic versioning (major.minor.patch). Agents declare their supported version in the agent card.

## [](#next-steps)Next steps

-   [Choose an Integration Pattern](https://docs.redpanda.com/agentic-data-plane/connect/integration-overview/)

-   [Create an Agent](https://docs.redpanda.com/agentic-data-plane/connect/create-agent/)