Repository navigation
[Feat]: PushNotificationConfig.authentication is ignored; no Authorization header is sent in push notifications #585
Description
Is your feature request related to a problem? Please describe.
The A2A protocol spec states that when a client provides a PushNotificationConfig with an authentication scheme (e.g. "schemes": ["Bearer"]), the A2A server must authenticate when sending push notifications to the client’s webhook.
Example config:
"configuration": {
"pushNotificationConfig": {
"url": "CALLBACK-URL",
"token": "secure-client-token-for-task-aaa",
"authentication": {
"schemes": ["Bearer"]
}
}
}However, the Python implementation (BasePushNotificationSender) completely ignores authentication and sends no Authorization header.
It only attaches:
X-A2A-Notification-Token: <token>
This means that webhook endpoints cannot authenticate the caller and cannot follow the security model described in the spec.
This appears to be a spec compliance gap: push notification authentication is described by the protocol but not implemented in the Python server.
Describe the solution you'd like
I would like the Python server to:
-
Honor
PushNotificationConfig.authentication -
Support at least the
"Bearer"scheme -
Automatically add the appropriate
Authorizationheader -
Match the spec examples by sending both:
X-A2A-Notification-TokenAuthorization: Bearer <token_or_jwt>
Describe alternatives you've considered
As a workaround, we currently:
- Subclass
BasePushNotificationSender - Override
_dispatch_notification - Inject our own
Authorization: Bearer <jwt>header
This works, but:
- It duplicates logic that should be part of the framework
- It breaks consistency between Python and other A2A implementations
- It makes spec-compliant webhook security non-standard and harder to maintain
A built-in implementation would make push notification authentication reliable, consistent, and aligned with the A2A spec.
Activity
DhanashreePetare commentedon Dec 16, 2025
Greetings @Tareqox ..I am interested to work on the issue. Can You please assign this to me. ThankYou
sokoliva commentedon Dec 16, 2025
Hi @DhanashreePetare. I added you as an assignee.
DhanashreePetare commentedon Dec 16, 2025
ThankYou @sokoliva..I will start working on it. I have a doubt. I came to this project via Linux Foundation websites and their via GSOC organizations, and I want to be in contact with the Linux foundation organization via some communication channel like discord. If you can help me in this, I would be grateful.ThankYou.
Tareqox commentedon Dec 16, 2025
@DhanashreePetare lets please align on this. Happy to drive the implemenation of this feature request together. FYI @sokoliva I already have a solution, but didnt raise the PR yet... so it might better to assign it to me
DhanashreePetare commentedon Dec 16, 2025
Ok @Tareqox . Did you mean we can work together on this, or this is to be assigned to you, was a bit confused by above message.
Tareqox commentedon Dec 16, 2025
Assign to me and I'll raise the PR in a bit and you can check that. @DhanashreePetare , FYI @sokoliva
sokoliva commentedon Dec 19, 2025
@Tareqox Thank you for bringing this to our attention and for opening a PR for this issue.
I noticed there are still two unresolved comments on the PR. Do you have plans to address those soon?
Tareqox commentedon Dec 19, 2025
@sokoliva Yes, I'm aware of that. I would like to get this done by the new year, as I am currently away on vacation. I will definitely address those asap once I am back. If I find time earlier, I'll do it this year.
sokoliva commentedon Jan 7, 2026
@DhanashreePetare Sorry for the late reply. Here is the discord link you requested: goo.gle/a2a-discord 🙂
isheng-eqi commentedon Jul 7, 2026
Submitted PR #1126 — BasePushNotificationSender now honors the authentication field and sends Authorization: Bearer when configured.
fix(server): send PushNotificationConfig.authentication as an Authori…
chore(main): release 1.2.0 (#1266)