Earning the extended card
Three lifelines: the platform team outside A2A, the planner, and the deployer. Seven steps appear in order. The planner reads the public card, which declares extendedAgentCard true and a bearer scheme. It calls GetExtendedAgentCard without an Authorization header and gets HTTP 401 with WWW-Authenticate: Bearer realm="deployer". The platform team issues a bearer token outside A2A. The planner calls again with the token and receives the extended card, whose skills are deploy and rollback and which carries no signature.
platform team
outside A2A
planner
client
deployer
port 41243
1
GET /.well-known/agent-card.json
2
public card
extendedAgentCard: true, scheme bearer
3
GetExtendedAgentCard
no Authorization header
4
HTTP 401 Unauthorized
WWW-Authenticate: Bearer realm="deployer"
5
bearer token
issued outside A2A
6
GetExtendedAgentCard
Authorization: Bearer dpl_test_7c1e4b
7
extended card
skills deploy and rollback, unsigned