DS DevShelfHub Projects · AI tools
Tutorials / CrewAI / Reference / Classes / EnterpriseTokenAuth
Class a2a

EnterpriseTokenAuth: Reference Guide

By DevShelfHub

A2A auth method tailored for CrewAI Enterprise/AMP — uses platform-issued tokens with org scope.

See the CrewAI API reference index, CrewAI introduction, and MCP & A2A tutorial for surrounding context.

What is EnterpriseTokenAuth?

EnterpriseTokenAuth plugs CrewAI's A2A client and server stacks into CrewAI Enterprise (AMP) identity: you supply a short-lived platform integration token minted by the control plane, and the auth object carries the org and role metadata AMP expects when brokering calls between governed crews. It is the managed counterpart to hand-rolled APIKeyAuth or OAuth2ClientCredentials when you already run inside AMP and want rotation, revocation, and audit trails handled centrally.

Operationally, treat the token like any other secret: load it from environment variables or a secret manager at process start, never commit literals, and rebuild A2AClientConfig when AMP rotates credentials. Because EnterpriseTokenAuth is narrower than generic OAuth, it should not be used for arbitrary third-party SaaS APIs — reach for OAuth2ClientCredentials or BearerTokenAuth when the remote peer is not AMP.

Install the `crewai[a2a]` extra wherever this type is imported, and keep CrewAI versions aligned with the AMP release channel so token claims and transport headers stay compatible across upgrades.

When to Use

Inside CrewAI Enterprise/AMP deployments.

Use Cases

  • • AMP-managed A2A

Key Features

  • ✓ Org/role scoping
  • ✓ Platform-native

When NOT to Use

Outside the platform.

Notes

Token lifetime vs long kicks

If a delegated A2A kickoutlives the AMP token TTL, mid-flight 401 errors look like generic agent failures. Refresh proactively or shorten remote work units.

Org scoping mistakes

Tokens minted for org A will be rejected when pointed at org B endpoints even if the URL looks similar. Centralize base_url selection per tenant.

Logging hygiene

Never log repr(auth) or exception payloads that echo headers. Structured logs should record success/failure and correlation IDs only.

Local development

Developers without AMP access cannot mint platform tokens. Provide a stub A2A stack or fall back to APIKeyAuth against a local mock while keeping production paths on EnterpriseTokenAuth.

Import

python 
from crewai.a2a.auth import EnterpriseTokenAuth

Key Parameters

Parameter Type Default Purpose
token str — Platform token.

Code Examples

Read token from environment

python 
import os
from crewai.a2a.auth import EnterpriseTokenAuth

auth = EnterpriseTokenAuth(token=os.environ['CREWAI_PLATFORM_INTEGRATION_TOKEN'])

Outbound A2AClientConfig

python 
import os
from crewai.a2a import A2AClientConfig
from crewai.a2a.auth import EnterpriseTokenAuth

cfg = A2AClientConfig(
    base_url=os.environ['AMP_A2A_BASE_URL'],
    auth=EnterpriseTokenAuth(token=os.environ['CREWAI_PLATFORM_INTEGRATION_TOKEN']),
)

Rebuild after rotation

python 
def fresh_cfg() -> A2AClientConfig:
    token = os.environ['CREWAI_PLATFORM_INTEGRATION_TOKEN']
    return A2AClientConfig(
        base_url=os.environ['AMP_A2A_BASE_URL'],
        auth=EnterpriseTokenAuth(token=token),
    )

Common Mistakes

❌ Hard-coding tokens in git-tracked YAML

✅ Inject via environment variables or AMP secret references at deploy time.

EnterpriseTokenAuth FAQ

What is EnterpriseTokenAuth in CrewAI?

A2A auth method tailored for CrewAI Enterprise/AMP — uses platform-issued tokens with org scope. EnterpriseTokenAuth plugs CrewAI's A2A client and server stacks into CrewAI Enterprise (AMP) identity: you supply a short-lived platform integration token minted by the control plane, and the auth object carries the org and role metadata AMP expects when brokering calls between governed crews. It is the managed counterpart to hand-rolled APIKeyAuth or OAuth2ClientCredentials when you already run inside AMP and want rotation, revocation, and audit trails handled centrally. Op…

Which package defines the CrewAI class EnterpriseTokenAuth?

DevShelfHub maps EnterpriseTokenAuth to Python module crewai.a2a.auth (package path crewai.a2a.auth in this reference). Pin your installed crewai version and match imports to the snippet on this page.

When should I use EnterpriseTokenAuth?

Inside CrewAI Enterprise/AMP deployments.

When should I avoid using EnterpriseTokenAuth?

Outside the platform.

How do I import EnterpriseTokenAuth in Python?

from crewai.a2a.auth import EnterpriseTokenAuth

Where can I explore more CrewAI API reference pages?

Open the CrewAI API reference index on DevShelfHub to search 58 classes, 30 methods, and 16 decorators, each with runnable examples, parameters, common mistakes, and cross-links.