A2A bridge

Configure an A2A bridge behind the P0 AI Gateway so P0-managed agents reach upstream agents under runtime authorization policy.

The A2A bridge component places an upstream agent host behind the P0 AI Gateway so that agent-to-agent (A2A) calls pass through the gateway. Where the MCP server component fronts the MCP servers your agents call, the A2A bridge extends the same governance to A2A traffic.

The Agentic Gateway integration is available as an opt-in capability. Contact P0 to enable it for your organization.

Prerequisites

• An existing P0 account at p0.app.

• A registered Gateway component, and the gateway deployed in your environment. See Deploying the P0 AI Gateway.

• The base URL where your upstream agents are hosted.

• An upstream agent host that accepts tokens minted by your gateway. The gateway calls each agent with a bearer token issued by the gateway's own OAuth server and addressed to that agent's URL, and the host verifies it against the keys published at <OAuth server endpoint>/.well-known/jwks.json. A host that trusts only its own identity provider rejects every call the bridge makes.

Add an A2A bridge

1. Navigate to Integrations on p0.app and select Agentic gateway, then choose the A2A bridge component.

2. Click Add A2A bridge.

3. Enter the bridge details, then finish the configuration:

   • A2A bridge identifier: a name for this bridge within P0. Use letters, digits, and hyphens only — the identifier becomes part of the gateway address that agents call.

   • Gateway: the registered gateway that fronts this bridge.

   • Agent host: the base URL at which your upstream agents are hosted. The gateway routes A2A calls to this URL.

4. The A2A bridge now appears in the component's list of configured bridges.

How it works

Once a bridge is configured, P0 reconciles it to the gateway alongside your MCP servers. When a P0-managed agent makes an A2A call through the gateway, the gateway verifies the caller's identity, authorizes the call against the policies you define in P0, and logs it before forwarding the call to the Agent host.

The gateway supplies its own credential to the upstream agent host: a natively minted gateway session token. Unlike an MCP server, an A2A bridge has no AWS, GCP, or OAuth credential source to configure.

Next steps

• Define the Agentic Access Policies that govern what agents can do through the bridge.

• Learn how an agent requests access to an agent behind the bridge, and the address it calls once access is granted.

• Configure the MCP servers you want to expose behind the same gateway.