DS DevShelfHub Projects · AI tools
Tutorials / CrewAI / Reference / Classes / APIKeyAuth
Class a2a

APIKeyAuth: Reference Guide

By DevShelfHub

A2A auth method: static API key in a header.

See the CrewAI API reference index, CrewAI introduction, and MCP & A2A tutorial for surrounding context.

What is APIKeyAuth?

APIKeyAuth wraps a long-lived shared secret the A2A client presents on every request, typically in a vendor-specific header or alongside the standard patterns your remote server expects. It is intentionally minimal: there is no refresh dance, which makes it attractive for internal meshes where network policy and VPC boundaries already enforce who can reach the endpoint.

Because the key is static, compromise recovery is binary: rotate the key everywhere it is configured and coordinate with every caller. Treat APIKeyAuth as a building block inside A2AClientConfig or A2AServerConfig rather than as your entire security story — pair it with TLS, short network paths, and rate limiting on the server. For user-scoped or tenant-scoped access, prefer BearerTokenAuth or OAuth2ClientCredentials instead.

When to Use

Internal A2A links between trusted services where a static shared secret is acceptable and rotation is operationally simple.

Use Cases

  • • Internal service-to-service
  • • Partner links inside a private network
  • • Bootstrap auth before OAuth is wired

Key Features

  • ✓ Header-based
  • ✓ Simple mental model
  • ✓ Fast to integrate

When NOT to Use

Cross-tenant SaaS, browser-exposed clients, or any surface where OAuth-style audience and scope matter.

Notes

Rotation playbook

Plan dual-key acceptance on the server during rotation: accept both the old and new key for a window, roll clients, then retire the old key. Without that, a single missed config update hard-downs traffic.

Never log the raw key

Structured loggers often serialize entire config objects. Strip or redact APIKeyAuth fields before logging, and forbid debug endpoints that echo credentials back to browsers.

Header collisions

Some gateways strip unknown headers. Confirm the exact header name your A2A stack uses and that intermediaries forward it. Misconfigured proxies cause mysterious 401 loops that look like application bugs.

Import

python 
from crewai.a2a.auth import APIKeyAuth

Key Parameters

Parameter Type Default Purpose
key str — API key value.

Code Examples

Read key from environment

python 
import os
from crewai.a2a.auth import APIKeyAuth

auth = APIKeyAuth(key=os.environ['A2A_INTERNAL_KEY'])

Use on outbound A2AClientConfig

python 
import os
from crewai.a2a import A2AClientConfig
from crewai.a2a.auth import APIKeyAuth

cfg = A2AClientConfig(
    base_url='https://a2a.internal.example',
    auth=APIKeyAuth(key=os.environ['A2A_INTERNAL_KEY']),
)

Pair with server-side APIKeyAuth gate

python 
import os
from crewai.a2a import A2AServerConfig
from crewai.a2a.auth import APIKeyAuth

server = A2AServerConfig(auth=APIKeyAuth(key=os.environ['INBOUND_A2A_KEY']), host='0.0.0.0', port=8080)

Common Mistakes

❌ Committing `APIKeyAuth(key='sk-...')` literals to git

✅ Load from environment variables or a secret manager at process startup.

❌ Reusing the same key for inbound server auth and outbound client auth

✅ Use distinct secrets so a client leak cannot impersonate your server.

APIKeyAuth FAQ

What is APIKeyAuth in CrewAI?

A2A auth method: static API key in a header. APIKeyAuth wraps a long-lived shared secret the A2A client presents on every request, typically in a vendor-specific header or alongside the standard patterns your remote server expects. It is intentionally minimal: there is no refresh dance, which makes it attractive for internal meshes where network policy and VPC boundaries already enforce who can reach the endpoint. Because the key is static, compromise recovery is binary: rotate the key everywhere it is configured and c…

Which package defines the CrewAI class APIKeyAuth?

DevShelfHub maps APIKeyAuth to Python module crewai.a2a.auth (package path crewai.a2a.auth in this reference). Pin your installed crewai version and match imports to the snippet on this page.

When should I use APIKeyAuth?

Internal A2A links between trusted services where a static shared secret is acceptable and rotation is operationally simple.

When should I avoid using APIKeyAuth?

Cross-tenant SaaS, browser-exposed clients, or any surface where OAuth-style audience and scope matter.

How do I import APIKeyAuth in Python?

from crewai.a2a.auth import APIKeyAuth

Where can I explore more CrewAI API reference pages?

Open the CrewAI API reference index on DevShelfHub to search 58 classes, 30 methods, and 16 decorators, each with runnable examples, parameters, common mistakes, and cross-links.