---
title: Connect a partner agent
description: A step-by-step guide to A2A from the console — try it with the Veefore sample partner, connect a real partner, send a test call, and call it from code.
---

A2A (agent-to-agent) lets one of your agents call an agent that someone else
runs — a supplier's shipping agent, a partner's booking agent. Veefore sits in
the middle: it checks the partner is who it says it is, checks your rules, and
records every call.

This guide does everything from the console. You do not need the API or a
terminal until you call the partner from your own code.

**Words used on this page:**

- **Your agent** — the agent in Veefore that makes the calls.
- **Partner** — the other organisation's agent.
- **Passport** — a signed ID card for an agent. Veefore checks the partner's
  passport against a **public key** you were given, so a partner cannot just
  claim to be someone.
- **Capability** — one thing you may ask the partner to do, such as
  `shipment.query`.

## Try it with the sample partner

The quickest way to see A2A work. The **Veefore sample partner** is a practice
agent Veefore runs for you: it answers `shipment.query`, refuses
`shipment.cancel` the way a real partner might, and advertises a "read-only"
`records.delete` that Veefore rates critical. Its passport is checked like any
other.

:::steps

:::step Open the A2A page

Sign in at [console.veefore.com](https://console.veefore.com) and set the
**Environment** switcher at the top to the environment you want — for example
**Development**. Open **A2A** in the left menu (under *Connect*) and click
**Connect a partner**.
:::

:::step Choose your agent

- If you already have an agent, pick it under **Your agent**. If it was not set
  up for A2A, the list says *A2A will be switched on* — Veefore does that for
  you.
- If you have none, type a name under **New agent name** (for example
  `Partner caller`) and click **Create agent**. It is selected for you.

Click **Next**.
:::

:::step Choose the sample partner

**Veefore sample partner** is selected by default. There is nothing to type.
Click **Connect**. If Veefore asks for your password, enter it — this is a
security check before connecting to someone outside your organisation.

Veefore registers the connection, checks the sample partner's passport, and
reads what it offers. You see **Passport verified**.
:::

:::step Choose what it may be asked to do

Veefore lists the partner's capabilities with its own risk rating:

| Capability | Rated | Ticked for you |
| --- | --- | --- |
| `shipment.query` | Medium | Yes — it only reads |
| `shipment.cancel` | High | No — it changes things |
| `records.delete` | Critical | No — it *claims* to be read-only; Veefore does not believe it |

Leave `shipment.query` ticked and click **Enable 1 capability**. Veefore
creates the capability, gives it to your agent, and sets up the tool your rules
check, so a call works straight away.
:::

:::step Send a test call

Click **Open the connection**. Under **Send a test call**:

1. **Capability:** `shipment.query`.
2. **Payload:** already filled in from the partner's description, for example
   `{ "trackingId": "TEST-1" }`. Change the id if you like.
3. Click **Send test call**.

You see **Sent and answered** (or **Sent (Observe mode)** in a new account)
with the partner's answer, such as `"status": "in_transit"` and an `eta`.
:::

:::step Check it worked

- On the connection, **Interaction log** lists the call.
- Open **Actions** in the left menu: the call is there with your agent, the
  tool `a2a_shipment_query` and the decision. Click it to see every check.
:::

:::step See the protection

Try each of these and watch what happens:

1. **A capability you did not enable.** Under **Capabilities**, the partner's
   `shipment.cancel` is not enabled, so it is not offered in the test call.
   Enable it, send a test call with it, and the partner itself refuses:
   *"Cancellations go through support."*
2. **Switch a capability off.** Click **Disable** next to `shipment.query`. It
   can no longer be called — by the test or by your agent's code.
3. **Block the partner.** Click **Block this connection** at the bottom and give
   a reason. Every call is refused at once, and the partner is never contacted.
   **Allow again** lets it back in.
:::

:::

## Connect a real partner

Click **A2A → Connect a partner**, choose your agent, then the kind of partner:

:::tabs

:::tab A partner on Veefore
The partner also uses Veefore. Ask them to:

1. Open **Agents**, then their agent, then the **Passport** tab.
2. Click **Copy for a partner** and send you the text, through a channel you
   both already trust (not the same place you are about to connect to).

Then, in your **Connect a partner**:

1. Choose **A partner on Veefore**.
2. Paste their text into **Their passport export**. Their agent id appears.
3. **Their A2A endpoint URL:** the address they give you, starting with
   `https://`.
4. Click **Connect**, then choose capabilities as above.
:::

:::tab Any A2A agent
For a partner that is not on Veefore.

1. Choose **Any A2A agent**.
2. **Their A2A endpoint URL:** the address they give you, starting with
   `https://`. Click **Read their Agent Card** — Veefore reads their public
   description and fills in their agent id and name.
3. **Their public key:** ask the partner for it directly. Do not copy it from
   the same address you are about to trust: whoever controls that address could
   put any key there.
4. **Their passport:** paste it if they gave you one. If not, leave it empty —
   the connection waits as *Pending* and you verify it later on the connection
   page under **Verify the remote passport**.
5. Click **Connect**, then choose capabilities.
:::

:::

Veefore only calls partners on a public `https://` address. A private,
`localhost` or plain `http://` address is refused.

## Let a partner connect to your agent

To be someone else's partner, send them your agent's passport:

1. **Agents** → your agent → **Passport** tab.
2. **Copy for a partner**, and send them the text.

It contains no secret: your agent's id, its signed passport, and the key that
verifies it.

## Call the partner from your agent's code

The connection page shows the code under **Call it from your agent's code**,
with your connection id filled in. Your agent needs its private key: either run
`npx veefore` in its project, or create the agent with **Agents → Create agent**,
which shows the four `.env.local` lines once.

:::tabs

:::tab TypeScript
```ts
import { VeeforeClient } from '@veefore/sdk';

const client = new VeeforeClient({
  gatewayUrl: process.env.VEEFORE_GATEWAY_URL!,
  agentId: process.env.VEEFORE_AGENT_ID!,
  keyId: process.env.VEEFORE_AGENT_KEY_ID!,
  privateKey: process.env.VEEFORE_AGENT_PRIVATE_KEY!,
});

const decision = await client.a2aInvoke({
  connection: 'a2a_…',
  capability: 'shipment.query',
  action: 'query',
  payload: { trackingId: 'TRK-1' },
});
console.log(decision.result); // the partner's answer
```

Install it with `npm install @veefore/sdk@1.8.0`.
:::

:::tab Python
```python
from veefore import guard_client

decision = guard_client().a2a_invoke(
    connection="a2a_…",
    capability="shipment.query",
    action="query",
    payload={"trackingId": "TRK-1"},
)
print(decision.result)  # the partner's answer
```

Install it with `pip install veefore-py==1.7.0`. `guard_client()` reads
`.env.local` from the current directory upwards.
:::

:::

## Turn on protection

A new account starts every environment in **Observe** mode: calls run and are
recorded, but your rules do not block anything. The connection's own checks —
the passport, the enabled capabilities, a block — work in every mode.

To have your rules decide:

1. **Policies → New policy**, choose **Starter — safe defaults**, click
   **Create draft**, then **Add binding** to your workspace and **Activate v1**.
2. **Admin → Settings → Gateway enforcement**, choose **Enforce**.

With the starter policy, capabilities rated `HIGH` or `CRITICAL` wait for a
person to approve them under **Approvals**. You can write your own rules for
A2A calls; see [A2A](/build/a2a#policy-on-a2a).

## Something not working?

See [A2A troubleshooting](/build/a2a-troubleshooting).

## Related

:::cards

:::card A2A reference | /build/a2a
Every A2A setting, the API, and policy on A2A.
:::

:::card A2A troubleshooting | /build/a2a-troubleshooting
Every message, and what to do.
:::

:::card Handle approvals | /build/handle-approvals
Wait, defer or throw, in code.
:::

:::