DS DevShelfHub Projects · AI tools
Tutorials / CrewAI / Reference / Classes / BearerTokenAuth
Class a2a

BearerTokenAuth: Reference Guide

By DevShelfHub

A2A auth method: OAuth-style bearer token in Authorization header.

See the CrewAI API reference index, CrewAI introduction, and MCP & A2A tutorial for surrounding context.

What is BearerTokenAuth?

BearerTokenAuth carries an opaque access token, usually a JWT or opaque OAuth access token, that the A2A client presents in an Authorization: Bearer header on each call. It maps cleanly to user-delegated flows where the upstream identity provider already performed authentication and your CrewAI job is acting with that delegated scope.

Unlike APIKeyAuth, bearer tokens are expected to expire. Production setups either refresh out-of-band and rebuild A2AClientConfig when the string changes, or wrap acquisition in a small factory that pulls a fresh token before kickoff. Clock skew between issuer and consumer can cause premature 401 responses, so monitor nbf and exp claims when using JWTs and tolerate a small negative skew window on the server if your provider documents one.

When to Use

Short-lived OAuth access tokens, session tokens from your auth gateway, or any A2A peer that expects Authorization: Bearer.

Use Cases

  • • User-context A2A
  • • OAuth-issued tokens
  • • Service tokens minted just-in-time before kickoff

Key Features

  • ✓ Authorization: Bearer
  • ✓ Fits OAuth-shaped APIs
  • ✓ Encourages TTL-bound credentials

When NOT to Use

Long-lived static shared secrets where rotation is rare — APIKeyAuth is simpler and clearer.

Notes

Expiry and mid-run failures

If a long kickoff outlives the token TTL, mid-flight 401 errors surface as generic agent failures. Refresh proactively based on exp, or use OAuth2ClientCredentials so the client library can mint fresh tokens without you hand-rolling timers.

Audience and scope

JWTs encode aud and scp claims. A token issued for your web API is not automatically valid for an A2A upstream — request the correct resource indicator from the identity provider or you will see valid-looking tokens rejected with opaque errors.

Logging

Bearer strings are bearer secrets. Never log Authorization headers, exception payloads from HTTP clients, or repr() of auth objects in shared telemetry.

Import

python 
from crewai.a2a.auth import BearerTokenAuth

Key Parameters

Parameter Type Default Purpose
token str — Bearer token.

Code Examples

Load token from environment for a job

python 
import os
from crewai.a2a.auth import BearerTokenAuth

auth = BearerTokenAuth(token=os.environ['PARTNER_OAUTH_ACCESS_TOKEN'])

Outbound A2AClientConfig with bearer

python 
from crewai.a2a import A2AClientConfig
from crewai.a2a.auth import BearerTokenAuth

cfg = A2AClientConfig(
    base_url='https://a2a.vendor.example',
    auth=BearerTokenAuth(token=os.environ['VENDOR_ACCESS_TOKEN']),
)

Rebuild after refresh (sketch)

python 
def build_cfg() -> A2AClientConfig:
    token = fetch_fresh_token()  # your OAuth client-credentials or refresh helper
    return A2AClientConfig(
        base_url='https://a2a.vendor.example',
        auth=BearerTokenAuth(token=token),
    )

Common Mistakes

❌ Caching a BearerTokenAuth for the lifetime of a multi-hour process without refresh

✅ Refresh tokens on a timer or switch to OAuth2ClientCredentials for service-to-service calls.

❌ Passing the refresh token as the bearer value

✅ Exchange the refresh token for an access token first; only access tokens belong in BearerTokenAuth.

BearerTokenAuth FAQ

What is BearerTokenAuth in CrewAI?

A2A auth method: OAuth-style bearer token in Authorization header. BearerTokenAuth carries an opaque access token, usually a JWT or opaque OAuth access token, that the A2A client presents in an Authorization: Bearer header on each call. It maps cleanly to user-delegated flows where the upstream identity provider already performed authentication and your CrewAI job is acting with that delegated scope. Unlike APIKeyAuth, bearer tokens are expected to expire. Production setups either refresh out-of-band and rebuild A2AClientConfig when the str…

Which package defines the CrewAI class BearerTokenAuth?

DevShelfHub maps BearerTokenAuth to Python module crewai.a2a.auth (package path crewai.a2a.auth in this reference). Pin your installed crewai version and match imports to the snippet on this page.

When should I use BearerTokenAuth?

Short-lived OAuth access tokens, session tokens from your auth gateway, or any A2A peer that expects Authorization: Bearer.

When should I avoid using BearerTokenAuth?

Long-lived static shared secrets where rotation is rare — APIKeyAuth is simpler and clearer.

How do I import BearerTokenAuth in Python?

from crewai.a2a.auth import BearerTokenAuth

Where can I explore more CrewAI API reference pages?

Open the CrewAI API reference index on DevShelfHub to search 58 classes, 30 methods, and 16 decorators, each with runnable examples, parameters, common mistakes, and cross-links.