Step 2: Add the SDK¶

from fastapi import FastAPI, Request
from fastapi.responses import JSONResponse

app = FastAPI(title="My A2A Agent")

@app.get("/.well-known/agent-card.json")
async def get_agent_card():
    """Return the agent card (A2A discovery endpoint)."""
    return {
        "name": "My Secure Agent",
        "description": "An A2A agent with CapiscIO security",
        "url": "http://localhost:8000",
        "version": "1.0.0",
        "protocolVersion": "0.2.0",
        "provider": {
            "organization": "My Company"
        },
        "capabilities": {
            "streaming": False,
            "pushNotifications": False
        },
        "skills": [
            {
                "id": "greeting",
                "name": "Greeting",
                "description": "Returns a friendly greeting"
            }
        ]
    }

@app.post("/")
async def handle_message(request: Request):
    """Handle incoming A2A messages."""
    body = await request.json()

    # Simple echo response
    return JSONResponse({
        "jsonrpc": "2.0",
        "id": body.get("id"),
        "result": {
            "message": f"Hello! You said: {body.get('params', {}).get('message', 'nothing')}"
        }
    })

if __name__ == "__main__":
    import uvicorn
    uvicorn.run(app, host="0.0.0.0", port=8000)

from fastapi import FastAPI, Request, HTTPException
from fastapi.responses import JSONResponse
from capiscio_sdk import SimpleGuard

app = FastAPI(title="My A2A Agent")

# Initialize SimpleGuard in dev mode (auto-generates keys)
guard = SimpleGuard(dev_mode=True)

@app.get("/.well-known/agent-card.json")
async def get_agent_card():
    """Return the agent card (A2A discovery endpoint)."""
    return {
        "name": "My Secure Agent",
        "description": "An A2A agent with CapiscIO security",
        "url": "http://localhost:8000",
        "version": "1.0.0",
        "protocolVersion": "0.2.0",
        "provider": {"organization": "My Company"},
        "capabilities": {"streaming": False, "pushNotifications": False},
        "public_keys": [
            # SimpleGuard exposes the public key for the agent card
        ],
        "skills": [
            {
                "id": "greeting",
                "name": "Greeting",
                "description": "Returns a friendly greeting"
            }
        ]
    }

@app.post("/")
async def handle_message(request: Request):
    """Handle incoming A2A messages with signature verification."""

    # 1. Get the JWS token from header
    jws_token = request.headers.get("X-Capiscio-JWS")
    if not jws_token:
        raise HTTPException(status_code=401, detail="Missing X-Capiscio-JWS header")

    # 2. Get the request body
    body = await request.body()

    # 3. Verify the signature
    try:
        claims = guard.verify_inbound(jws_token, body=body)
        print(f"✅ Verified request from: {claims.get('iss')}")
    except Exception as e:
        raise HTTPException(status_code=401, detail=f"Signature verification failed: {e}")

    # 4. Process the message
    data = await request.json()
    response_data = {
        "jsonrpc": "2.0",
        "id": data.get("id"),
        "result": {
            "message": f"Hello! You said: {data.get('params', {}).get('message', 'nothing')}"
        }
    }

    # 5. Sign the response
    response_body = JSONResponse(response_data).body
    response_headers = guard.make_headers({}, body=response_body)

    return JSONResponse(response_data, headers=response_headers)

if __name__ == "__main__":
    import uvicorn
    uvicorn.run(app, host="0.0.0.0", port=8000)