The agent card a2a-exposed serves

An agent card is a JSON document at /.well-known/agent-card.json that tells other agents an A2A agent's name, skills, endpoint, protocol versions and how to authenticate.

Every deployment serves its own card. Fetch the card from a Worker you deployed:

npx -y a2a-exposed@latest status

status fetches the card itself.

1.0 and 0.3

URL	Shape
`/.well-known/agent-card.json`	A2A 1.0. `supportedInterfaces` lists 1.0 first and 0.3 second.
`/.well-known/agent.json`	A2A 0.3. `url`, `protocolVersion`, `preferredTransport`.

Serve both. 1.0 clients want agent-card.json. 0.3 clients request agent.json. The Worker serves both on one host.

Security schemes

The 1.0 card lists two alternatives:

bearer: httpAuthSecurityScheme, the per-peer token.
pairing: oauth2SecurityScheme with a deviceCode flow (deviceAuthorizationUrl, tokenUrl, scopes, oauth2MetadataUrl).

That is the pairing flow.

What is scrubbed

Description, skills, provider URL and documentation URL are checked for private hosts: localhost, private IPs, *.ts.net, *.local, and similar. In public-front mode the whole upstream card is rewritten so interfaces point at the public URL, and signatures are dropped. See public front.

Apex of this website

https://a2a.exposed/.well-known/agent-card.json answers with a 404 JSON body. The apex publishes this site, and the demo agent stays off that URL.

Fields you set

init takes --agent-name, --agent-description, --agent-skills (a JSON array of AgentSkill objects), --provider-organization and --provider-url. The endpoint URL is the hostname you deployed.