adk_request_credential: Bearer Token Example

[patrick-hertling]

Bearer Token Example:
I couldn't find how to do this anywhere.

Usecase:
Agent with OpenApiToolset
API uses JWT in HTTP header like Authentication: Bearer eJasdfasdfadsf...
Token expires every hour

When Agent answers with adk_request_credential event, what am I supposed to give him exactly?

This is what I have tried:

POST /run

{
  "appName": "api_agent",
  "userId": "u_123",
  "sessionId": "s_125",
  "newMessage": {
    "role": "user",
    "parts": [
      {
        "function_response": {
          "id": "adk-22bf4fc3-b66c-401d-8d63-a12282672f12",
          "name": "adk_request_credential",
          "response": {
            "authScheme": {
              "type": "http",
              "scheme": "bearer",
              "bearerFormat": "JWT"
            },
            "credentialKey": "adk_http_3406774919278891756_",
            "authCredentials": {
              "type": "http",
              "http": {
                "scheme": "bearer",
                "credentials": {
                  "token": "token goes here"
                }
              }
            }
          }
        }
      }
    ]
  }
}

We can never get the agent to continue the flow.
He always response that he does not have the credentials.

Can you help us?

[lesamuuu]

I m having the same problem

[natansalvadorligabo]

I'm having the same problem, has anyone found a solution?

[abetekgeo]

Not sure if my solution would be useful, given that I am using OAuth flow and my adk runtime/invoker is in python, but I was able to get it to work by also setting a temp state variable as the authenticated tool expects. The following script triggers

async def respond_with_flow(
    auth_request_function_call_id: str, auth_config: AuthConfig
):
    # Run interactive OAuth (opens browser)
    creds = get_credentials()
    if not creds or not creds.token:
        print("OAuth failed or no access token.")
        return

    auth_credential = google_creds_to_auth_credential(creds)

    function_response = types.FunctionResponse(
        name="adk_request_credential",
        # response=auth_config.model_dump(),
        response={
            "authScheme": auth_config.auth_scheme.model_dump(),
            "exchangedAuthCredential": auth_credential,  # .model_dump(),
            "status": "granted",
        },
        id=auth_request_function_call_id,
    )
    response_content = types.Content(
        role="user",
        parts=[types.Part(function_response=function_response)],
    )
    # Store the credentials in the agent's state for future use
    credentials_state_key = "temp:" + auth_config.credential_key
    session_service.sessions[APP_NAME][USER_ID][SESSION_ID_TOOL_AGENT].state[
        credentials_state_key
    ] = auth_credential
    print("\nSubmitting authentication details back to the agent...")

    async for event in runner.run_async(
        user_id=USER_ID,
        session_id=SESSION_ID_TOOL_AGENT,
        new_message=response_content,
    ):
    if event.is_final_response() and event.content and event.content.parts:
        final_response_content = event.content.parts[0].text
        print(f"Agent Response: {final_response_content}")

Reference

1. https://github.com/google/adk-python/blob/main/src/google/adk/tools/tool_context.py#L75
2. https://github.com/google/adk-python/blob/main/src/google/adk/auth/auth_handler.py#L55C13-L55C42