DS DevShelfHub Projects · AI tools
Tutorials / CrewAI / Reference / Classes / OAuth2ClientCredentials
Class a2a

OAuth2ClientCredentials: Reference Guide

By DevShelfHub

A2A auth method: OAuth2 client-credentials grant — exchanges client_id/secret for a short-lived token.

See the CrewAI API reference index, CrewAI introduction, and MCP & A2A tutorial for surrounding context.

What is OAuth2ClientCredentials?

OAuth2ClientCredentials wraps the machine-to-machine grant your identity provider already exposes: the CrewAI client exchanges client_id and client_secret at token_url for an access token, caches it, and refreshes before expiry when the library supports proactive rotation. That pattern fits outbound A2AClientConfig calls to partner agents where no end-user browser is involved — billing integrations, internal platform agents, and nightly batch jobs are canonical examples.

Unlike BearerTokenAuth, you do not hand CrewAI a static JWT string that silently expires mid-run unless you refresh it yourself. The trade-off is operational complexity: you must register clients, rotate secrets, and configure scopes/audiences exactly as the IdP expects. Mis-scoped tokens fail with opaque 401/403 responses that look like Crew bugs unless you log token endpoint diagnostics separately from agent traces.

Install the `crewai[a2a]` extra wherever A2A auth types import, and never commit client_secret literals to YAML tracked in git — inject them from your secret manager at deploy time.

When to Use

Anywhere you'd run OAuth2 client-credentials grant.

Use Cases

  • • Enterprise A2A
  • • Cross-tenant calls

Key Features

  • ✓ Auto-refresh
  • ✓ Token caching

When NOT to Use

User-impersonation flows — those need a different grant.

Notes

Audience and scope

Token responses are only valid for the APIs named in aud and scope. Request an audience that explicitly includes the A2A upstream, not just your generic API resource.

Clock skew

Tokens validated with exp can fail on hosts minutes out of sync with NTP. Fix infrastructure drift before tuning CrewAI retry knobs.

Logging

Never log client_secret, refresh responses, or raw Authorization headers. Structured logs should record success, correlation id, and token endpoint HTTP status only.

Import

python 
from crewai.a2a.auth import OAuth2ClientCredentials

Key Parameters

Parameter Type Default Purpose
client_id / client_secret str — OAuth2 credentials.
token_url str — Token endpoint.

Code Examples

Minimal A2AClientConfig wiring

python 
import os
from crewai.a2a import A2AClientConfig
from crewai.a2a.auth import OAuth2ClientCredentials

auth = OAuth2ClientCredentials(
    client_id=os.environ['A2A_CLIENT_ID'],
    client_secret=os.environ['A2A_CLIENT_SECRET'],
    token_url='https://idp.example.com/oauth/token',
)

cfg = A2AClientConfig(base_url='https://a2a.partner.example', auth=auth)

Rebuild config after secret rotation

python 
def build_cfg() -> A2AClientConfig:
    return A2AClientConfig(
        base_url=os.environ['PARTNER_A2A_BASE'],
        auth=OAuth2ClientCredentials(
            client_id=os.environ['A2A_CLIENT_ID'],
            client_secret=os.environ['A2A_CLIENT_SECRET'],
            token_url=os.environ['A2A_TOKEN_URL'],
        ),
    )

Pair with conservative polling updates

python 
from crewai.a2a.updates import PollingConfig

cfg = A2AClientConfig(
    base_url='https://a2a.partner.example',
    auth=OAuth2ClientCredentials(
        client_id=os.environ['A2A_CLIENT_ID'],
        client_secret=os.environ['A2A_CLIENT_SECRET'],
        token_url='https://idp.example.com/oauth/token',
    ),
    updates=PollingConfig(interval_s=5.0),
)

Common Mistakes

❌ Reusing web-app OAuth clients that only allow authorization-code grant

✅ Create a dedicated client-credentials client with the right grant_types_enabled at the IdP.

❌ Embedding secrets in crew YAML checked into git

✅ Load from environment or secret manager at process start.

OAuth2ClientCredentials FAQ

What is OAuth2ClientCredentials in CrewAI?

A2A auth method: OAuth2 client-credentials grant — exchanges client_id/secret for a short-lived token. OAuth2ClientCredentials wraps the machine-to-machine grant your identity provider already exposes: the CrewAI client exchanges client_id and client_secret at token_url for an access token, caches it, and refreshes before expiry when the library supports proactive rotation. That pattern fits outbound A2AClientConfig calls to partner agents where no end-user browser is involved — billing integrations, internal platform agents, and nightly batch jobs are canonical examples. Unl…

Which package defines the CrewAI class OAuth2ClientCredentials?

DevShelfHub maps OAuth2ClientCredentials to Python module crewai.a2a.auth (package path crewai.a2a.auth in this reference). Pin your installed crewai version and match imports to the snippet on this page.

When should I use OAuth2ClientCredentials?

Anywhere you'd run OAuth2 client-credentials grant.

When should I avoid using OAuth2ClientCredentials?

User-impersonation flows — those need a different grant.

How do I import OAuth2ClientCredentials in Python?

from crewai.a2a.auth import OAuth2ClientCredentials

Where can I explore more CrewAI API reference pages?

Open the CrewAI API reference index on DevShelfHub to search 58 classes, 30 methods, and 16 decorators, each with runnable examples, parameters, common mistakes, and cross-links.