---
source: https://a2a.exposed/docs/agent-card
---

# The agent card a2a-exposed serves

An agent card is a JSON document at `/.well-known/agent-card.json` that tells other agents an A2A agent's name, skills, endpoint, protocol versions and how to authenticate.

Every deployment serves its own card. Fetch the card from a Worker you deployed:

```bash
npx -y a2a-exposed@latest status
```

`status` fetches the card itself.

## 1.0 and 0.3

| URL | Shape |
|---|---|
| `/.well-known/agent-card.json` | A2A 1.0. `supportedInterfaces` lists 1.0 first and 0.3 second. |
| `/.well-known/agent.json` | A2A 0.3. `url`, `protocolVersion`, `preferredTransport`. |

Serve both. 1.0 clients want `agent-card.json`. 0.3 clients request `agent.json`. The Worker serves both on one host.

## Security schemes

The 1.0 card lists two alternatives:

- `bearer`: `httpAuthSecurityScheme`, the per-peer token.
- `pairing`: `oauth2SecurityScheme` with a `deviceCode` flow (`deviceAuthorizationUrl`, `tokenUrl`, `scopes`, `oauth2MetadataUrl`).

That is the [pairing](/security/pairing) flow.

## What is scrubbed

Description, skills, provider URL and documentation URL are checked for private hosts: localhost, private IPs, `*.ts.net`, `*.local`, and similar. In public-front mode the whole upstream card is rewritten so interfaces point at the public URL, and `signatures` are dropped. See [public front](/public-front).

## Apex of this website

`https://a2a.exposed/.well-known/agent-card.json` answers with a 404 JSON body. The apex publishes this site, and the demo agent stays off that URL.

## Fields you set

`init` takes `--agent-name`, `--agent-description`, `--agent-skills` (a JSON array of AgentSkill objects), `--provider-organization` and `--provider-url`. The endpoint URL is the hostname you deployed.