Keep secrets private
Required · boundary
Never publish real API keys in a Remix project, CMS field, Agent Card, llms.txt, code example, or screenshot.
Token delivery Out of band
Storage Client-controlled
DOCS / QUICKSTART
First request, with the boundary visible.
Use the public Agent Card to discover the preferred interface, then authenticate out of band and send a bounded research request.
2. Authenticate
Obtain a token out of band.
The demo card declares bearer authentication. Your production process must explain how authorized clients obtain, rotate, and revoke tokens.
Rotate and revoke
Required · lifecycle
Use short-lived credentials, document rotation, and make revocation possible without editing public discovery files.
Issue Authorized clients
Revoke Server-side
Use least privilege
Required · scope
Grant only the capability required for the bounded request and log which agent version handled it.
Scope Minimum required
Audit Version recorded
3. Request
Send a bounded request.
POST JSON-RPC to the documented /a2a endpoint with Authorization, Content-Type, A2A-Version, messageId, role, and bounded text.
Required headers
Authorization: Bearer <token>
Content-Type: application/json
A2A-Version: 1.0
method: SendMessage
Required message fields
message.messageId
role: ROLE_USER
parts[].text
Bounded public-source request
4. Verify
Verify the result.
Review every material claim, limitation, inaccessible source, and the Agent version used. Model confidence is not evidence.
Response verification checklist
Claims
Source boundary
Unsupported claims visible
Limitations
Explicit
Missing or inaccessible sources disclosed
Confidence
Not evidence
Human review required
Agent version
Recorded
Reproducibility
Template boundary. This is fictional demo content. Replace every endpoint, organization, authentication statement, skill and version before publishing. The template does not make an Agent Server A2A-compliant.