External agents

Agents that run entirely outside the platform can still be first-class participants in it. Registering an external agent by URL puts it on the Agents list and makes it available to workflows, with the platform attaching the right credential on every call.

Registration is card-driven: the platform fetches the agent's A2A agent card and uses what the card declares — name, description, skills, and authentication requirements — instead of asking you to describe the agent by hand.

Registering an agent

From Build → Agents → Register A2A agent:

1. Enter the agent's URL — its base URL (the card is read from /.well-known/agent-card.json) or a direct link to the card file — and click Fetch card. The console previews the card: name, description, version, and declared skills. If the card itself is protected, configure the credential first and fetch again.
2. Configure authentication. The card's declared security schemes are rendered as the credential form:
   • API key — collected and sent under the header name and location the scheme declares.
   • HTTP bearer / HTTP basic — a token, or a username and password.
   • OAuth 2.0 / OpenID Connect — the platform doesn't execute these flows; provide a pre-issued access token, sent as a bearer token.
   • Mutual TLS and other schemes are not supported for platform dispatch. If the card declares no schemes you can configure a credential manually, and you can always register with no credential — though if the card declares auth, unauthenticated calls will likely fail.
3. Register. The credential is sent server-side only and sealed by the platform — it is attached to every call made to the agent, but is never readable back; the console only ever shows the credential type (and header name for API keys), never the value.

After registration

Registered external agents appear in their own External agents section on the Agents list, showing the endpoint URL, the configured auth type, and the registration date. From there they can be deregistered.

In the workflow builder, external agents appear in the agent picker alongside platform-built agents and are dispatched by their card name, with the sealed credential attached automatically on each call.