What is PushNotificationConfig?
PushNotificationConfig flips the A2A update model: instead of your client polling or holding a stream open, the remote CrewAI side POSTs progress payloads to callback_url you operate. A shared secret signs each body so your ingress can reject forged traffic before it touches application code. That makes the mode natural for serverless workers, queue consumers, and cross-VPC integrations where inbound long-lived streams are blocked but HTTPS callbacks are allowed.
Operationally you own idempotency, deduplication, and ordering guarantees — webhooks may retry on timeouts and can arrive slightly out of order under load. Persist event IDs if the payload exposes them and guard handler runtime so a poison message cannot wedge the worker pool. Rotate the secret by dual-signing during cutover windows and keep TLS termination on a well-scanned edge because the callback URL is effectively a public ingress.
Compared with StreamingConfig, push avoids maintaining a client-side reader loop; compared with PollingConfig, it cuts latency without fixed-interval traffic. The cost is running a reliable HTTPS endpoint and verifying HMAC on every request.
When to Use
Async pipelines, serverless handlers, Kubernetes Jobs, or partner networks where you can host a signed webhook but not a long-lived client stream.
Use Cases
- • Serverless event flows
- • Cross-team integrations
- • Partner callbacks behind API gateways
- • Resume-friendly progress fan-out
Key Features
- ✓ HMAC-signed payloads
- ✓ Callback URL driven
- ✓ Pairs with A2AClientConfig.updates
When NOT to Use
Local CLIs and notebooks where StreamingConfig is simpler, or environments that cannot expose a stable public callback URL.
Notes
Signature verification is mandatory
Never parse JSON before authenticating the MAC. Constant-time comparison prevents timing leaks, and rejecting unsigned test traffic in staging catches misconfigured partners early.
Public URL and authZ
callback_url must be reachable from the remote crew's egress. Lock the route to source IPs if the vendor publishes ranges, or front it with mutual TLS. Rate-limit per sender to absorb accidental retry storms.
Secret lifecycle
Store the secret in a manager, not git. Rotation means deploying a new secret, accepting both signatures briefly, then revoking the old material — document the cutover because dropped events look like silent stalls.
Duplicate deliveries
Assume at-least-once semantics. Use idempotent handlers keyed by remote task identifiers when the payload includes them; otherwise dedupe on a hash of the body with a short TTL cache.
Import
from crewai.a2a.updates import PushNotificationConfigKey Parameters
| Parameter | Type | Default | Purpose |
|---|---|---|---|
| callback_url | str | — | Where to POST updates. |
| secret | str | — | Shared secret for HMAC. |
Code Examples
Wire into A2AClientConfig
import os
from crewai.a2a.client import A2AClientConfig
from crewai.a2a.updates import PushNotificationConfig
from crewai.a2a.auth import BearerTokenAuth
cfg = A2AClientConfig(
base_url='https://a2a.partner.example',
auth=BearerTokenAuth(token=os.environ['PARTNER_A2A_TOKEN']),
updates=PushNotificationConfig(
callback_url='https://api.mycompany.com/v1/a2a/callback',
secret=os.environ['A2A_WEBHOOK_SECRET'],
),
)FastAPI stub verifying HMAC (pseudo-handler)
from fastapi import FastAPI, Request, HTTPException
import hmac, hashlib
app = FastAPI()
SECRET = b'replace-with-env'
@app.post('/v1/a2a/callback')
async def a2a_callback(request: Request):
body = await request.body()
sig = request.headers.get('X-Signature', '')
mac = hmac.new(SECRET, body, hashlib.sha256).hexdigest()
if not hmac.compare_digest(sig, mac):
raise HTTPException(status_code=401)
return {'ok': True}Contrast update modes in config
from crewai.a2a.updates import PushNotificationConfig, PollingConfig, StreamingConfig
push_updates = PushNotificationConfig(callback_url='https://hooks.example/a2a', secret='rotate-me')
poll_updates = PollingConfig(interval_s=3.0)
stream_updates = StreamingConfig()Common Mistakes
❌ Skipping HMAC verification on inbound webhooks
✅ Verify before enqueueing work; reject unknown signatures with 401.
❌ Pointing callback_url to localhost from a remote crew
✅ Expose a tunnel (ngrok) in dev or a public ingress in prod.
PushNotificationConfig FAQ
What is PushNotificationConfig in CrewAI?
Configures an A2A client to receive updates via push notifications (HMAC-signed webhooks). PushNotificationConfig flips the A2A update model: instead of your client polling or holding a stream open, the remote CrewAI side POSTs progress payloads to callback_url you operate. A shared secret signs each body so your ingress can reject forged traffic before it touches application code. That makes the mode natural for serverless workers, queue consumers, and cross-VPC integrations where inbound long-lived streams are blocked but HTTPS callbacks are allowed. Operational…
Which package defines the CrewAI class PushNotificationConfig?
DevShelfHub maps PushNotificationConfig to Python module crewai.a2a.updates (package path crewai.a2a.updates in this reference). Pin your installed crewai version and match imports to the snippet on this page.
When should I use PushNotificationConfig?
Async pipelines, serverless handlers, Kubernetes Jobs, or partner networks where you can host a signed webhook but not a long-lived client stream.
When should I avoid using PushNotificationConfig?
Local CLIs and notebooks where StreamingConfig is simpler, or environments that cannot expose a stable public callback URL.
How do I import PushNotificationConfig in Python?
from crewai.a2a.updates import PushNotificationConfig
Where can I explore more CrewAI API reference pages?
Open the CrewAI API reference index on DevShelfHub to search 58 classes, 30 methods, and 16 decorators, each with runnable examples, parameters, common mistakes, and cross-links.