feat: ServiceAccount with ID token option by lpezet · Pull Request #4474 · google/adk-python

lpezet · 2026-02-13T03:12:17Z

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

Closes: ServiceAccountCredentialExchanger: ID Token kind #4458

Problem:
ServiceAccountCredentialExchanger implementation is restricted to OAuth2-type tokens (access token).
For Service-to-Service authentication, ID token+audience is needed.

Solution:
Provide attributes in ServiceAccount auth config to specify ID token-type auth.

Testing Plan

Unit Tests:

I have added or updated unit tests for my change.
All unit tests pass locally.

NB: Some of test_cli_deploy.py fail for me but I have not changed anything there:

FAILED tests/unittests/cli/utils/test_cli_deploy.py::TestValidateAgentImport::test_success_with_app_export - click.exceptions.ClickException: Failed to import agent module:
FAILED tests/unittests/cli/utils/test_cli_deploy.py::TestValidateAgentImport::test_raises_on_import_error - assert 'nonexistent_module' in "Failed to import agent module:\nNo module named 'test_raises_on_import_error0'\n\nPlease ensure all dependencies are ... omitting --validate-agent-import (default) or passing --skip-agent-import-validat...
FAILED tests/unittests/cli/utils/test_cli_deploy.py::TestValidateAgentImport::test_cleans_up_sys_modules - click.exceptions.ClickException: Failed to import agent module:

Manual End-to-End (E2E) Tests:

In my setup I have a custom MCP Server deployed to Cloud Run running under a SA "producer", NOT public, and with a SA "consumer" granted "role/run.invoker" on that service.

Create VM instance with SA "consumer"

gcloud compute instances create adk-test-instance \
    --zone=us-central1-a \
    --machine-type=e2-micro \
    --image-family=ubuntu-2204-lts \
    --image-project=ubuntu-os-cloud \
    --service-account=$SA \
    --scopes=https://www.googleapis.com/auth/cloud-platform

SSH into instance

gcloud compute ssh adk-test-instance --zone=$ZONE

Clone branch and set things up

git clone --single-branch --branch feat/service-account-id-token https://github.com/lpezet/adk-python.git
cd adk-python
curl -LsSf https://astral.sh/uv/install.sh | sh
source $HOME/.local/bin/env
uv venv --python "python3.11" ".venv"
source .venv/bin/activate
uv sync --all-extras

Create test

mkdir tests/integration/fixture/adk_id_token/
cd tests/integration/fixture/adk_id_token/
echo "from . import agent" > __init__.py
vi agent.py

Paste the following:

import os
from google.adk import Agent
from google.genai import types

from google.adk.tools.mcp_tool.mcp_toolset import McpToolset
from google.adk.tools.mcp_tool.mcp_session_manager import StreamableHTTPConnectionParams
from google.adk.auth.auth_credential import AuthCredential, AuthCredentialTypes, ServiceAccount

from fastapi.openapi.models import OAuth2
from fastapi.openapi.models import OAuthFlowClientCredentials
from fastapi.openapi.models import OAuthFlows

# Check necessary environment variables
MCP_BASE_URL = os.getenv("MCP_BASE_URL") # custom remote MCP server base URL, deployed in say Cloud Run or GCE, e.g. "https://your-service-xyz-uc.a.run.app"
if not MCP_BASE_URL:
  raise ValueError(
      "MCP_BASE_URL environment variable is not set. Please set it"
      " to the MCP URL."
  )

SCOPES = {"https://www.googleapis.com/auth/cloud-platform": ""}

auth_scheme=OAuth2(
    flows=OAuthFlows(
        clientCredentials=OAuthFlowClientCredentials(
            tokenUrl="https://oauth2.googleapis.com/token",
            scopes=SCOPES,
        )
    )
)
auth_credential = AuthCredential(
    auth_type=AuthCredentialTypes.SERVICE_ACCOUNT, service_account=ServiceAccount(use_default_credential = True, scopes=SCOPES.keys(), token_kind="id_token", audience=MCP_BASE_URL)
)
mcp_toolset = McpToolset(
    connection_params=StreamableHTTPConnectionParams(url=f"{MCP_BASE_URL}/mcp"),
    auth_scheme=auth_scheme,
    auth_credential=auth_credential,
)

root_agent = Agent(
    model="gemini-2.5-flash",
    name="agent",
    description="A helpful assistant to talk to.",
    instruction="""You are a helpful assistant to talk to.
    """,
    tools=[mcp_toolset],
)

Run adk

cd tests/integration/fixture/
ask run adk_id_token

Test MCP tool calls

Checklist

I have read the CONTRIBUTING.md document.
I have performed a self-review of my own code.
I have commented my code, particularly in hard-to-understand areas.
I have added tests that prove my fix is effective or that my feature works.
New and existing unit tests pass locally with my changes.
I have manually tested my changes end-to-end.
Any dependent changes have been merged and published in downstream modules.

Additional context

gemini-code-assist · 2026-02-13T03:12:22Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

ryanaiagent · 2026-02-13T07:15:17Z

/gemini review

gemini-code-assist · 2026-02-13T07:15:21Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

…edential potentially being None.

ryanaiagent · 2026-02-19T19:00:45Z

/gemini review

gemini-code-assist

Code Review

This pull request adds the ability to use ID tokens with Service Accounts, which is a great feature for service-to-service authentication. The implementation looks solid, with changes to the ServiceAccount model, the credential exchanger logic, and corresponding unit tests.

I've left a few comments on potential improvements:

In service_account_exchanger.py, there are a couple of redundant checks for service_account_credential that can be removed to simplify the code, as this is already handled at the beginning of the function. I also noticed an opportunity to reuse a Request object for better performance and consistency.
In the new tests, there's a redundant monkeypatch call that can be removed.

Overall, the changes are well-implemented and tested. Addressing these minor points will improve code clarity and maintainability.

gemini-code-assist · 2026-02-19T19:03:26Z

src/google/adk/tools/openapi_tool/auth/credential_exchangers/service_account_exchanger.py

+          if config.service_account_credential is None:
+            raise ValueError("service_account_credential is required when use_default_credential is False")
+


This check for service_account_credential is redundant. A check at the beginning of the exchange_credential method (lines 62-69) already ensures service_account_credential is provided when use_default_credential is false. This check also raises a more specific AuthCredentialMissingError. Please remove this redundant check and the extra newline.

gemini-code-assist · 2026-02-19T19:03:26Z

src/google/adk/tools/openapi_tool/auth/credential_exchangers/service_account_exchanger.py

+          if config.service_account_credential is None:
+            raise ValueError("service_account_credential is required when use_default_credential is False")


Similar to the id_token path, this check for service_account_credential is redundant. The check at the beginning of the method already covers this case. Please remove this redundant check for consistency and to avoid confusion.

gemini-code-assist · 2026-02-19T19:03:26Z

src/google/adk/tools/openapi_tool/auth/credential_exchangers/service_account_exchanger.py

+          )
+          quota_project_id = None
+
+        credentials.refresh(Request())


For consistency and potential performance benefits, it's better to reuse the request object that was instantiated on line 79. The google-auth library is designed to allow reusing transport sessions. Please change this to credentials.refresh(request).

Suggested change

credentials.refresh(Request())

credentials.refresh(request)

gemini-code-assist · 2026-02-19T19:03:26Z

tests/unittests/tools/openapi_tool/auth/credential_exchangers/test_service_account_exchanger.py

+  monkeypatch.setattr(
+      google.oauth2.id_token,
+      "fetch_id_token",
+      mock_fetch_id_token,
+  )


This monkeypatch.setattr call is redundant. The subsequent patch on lines 237-240 targets the fetch_id_token function where it's used within the service_account_exchanger module, which is the correct and sufficient way to patch it for this test. You can remove this patch.

ryanaiagent · 2026-02-19T19:29:39Z

Hi @lpezet , Thank you for your contribution! We appreciate you taking the time to submit this pull request.

Can you implement the bot suggestions.
Fix the failing unit tests and mypydiff tests.
Also run autoformat.sh to fix the formatting errors.

lpezet · 2026-02-20T04:08:35Z

@ryanaiagent

I implemented the bot suggestions.
I have no idea how to fix the dependencies error mentioned in most of the failed checks (which now disappeared after pushing my changes and forgot to copy the errors).
I ran autoformat.sh, pytest ./tests/unittests, uv build, and tested "the locally built wheel file" (as per CONTRIBUTING.md.
The only files affected by autoformat.sh are files I did not touch:

$ ./autoformat.sh 
---------------------------------------
|  Organizing imports for src/...
---------------------------------------
All done! ✨ 🍰 ✨
---------------------------------------
|  Organizing imports for tests/...
---------------------------------------
All done! ✨ 🍰 ✨
---------------------------------------
|  Organizing imports for contributing/...
---------------------------------------
All done! ✨ 🍰 ✨
---------------------------------------
|  Auto-formatting src/...
---------------------------------------
All done! ✨ 🍰 ✨
452 files left unchanged.
---------------------------------------
|  Auto-formatting tests/...
---------------------------------------
All done! ✨ 🍰 ✨
388 files left unchanged.
---------------------------------------
|  Auto-formatting contributing/...
---------------------------------------
All done! ✨ 🍰 ✨
321 files left unchanged.
$ gs
On branch feat/service-account-id-token
Your branch is up to date with 'origin/feat/service-account-id-token'.

Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
        modified:   contributing/samples/gepa/experiment.py
        modified:   contributing/samples/gepa/run_experiment.py

no changes added to commit (use "git add" and/or "git commit -a")

I've been burnt before contributing to other Google projects, and this really is an Auth concern that, as other comments in the code mentioned, might need more thoughts than my little PR.

READ: I'm not going to do much more unless you can tell me this has high chances to be merged.

Can now specify token kind+audience in ServiceAccount auth config.

8a0b3ef

lpezet changed the title ~~ServiceAccount with ID token option~~ feat: ServiceAccount with ID token option Feb 13, 2026

adk-bot added the core [Component] This issue is related to the core interface and implementation label Feb 13, 2026

ryanaiagent self-assigned this Feb 13, 2026

lpezet added 4 commits February 18, 2026 19:26

Protecting against auth_credential.service_account.service_account_cr…

1914ab0

…edential potentially being None.

Merge branch 'main' into feat/service-account-id-token

5dace8c

Merge branch 'main' into feat/service-account-id-token

c91d6d3

Merge branch 'main' into feat/service-account-id-token

824652a

gemini-code-assist bot reviewed Feb 19, 2026

View reviewed changes

ryanaiagent added the request clarification [Status] The maintainer need clarification or more information from the author label Feb 19, 2026

Cleaning up code.

10b0539

		if config.service_account_credential is None:
		raise ValueError("service_account_credential is required when use_default_credential is False")

Conversation

lpezet commented Feb 13, 2026

Link to Issue or Description of Change

Testing Plan

Checklist

Additional context

Uh oh!

gemini-code-assist bot commented Feb 13, 2026

Uh oh!

ryanaiagent commented Feb 13, 2026

Uh oh!

gemini-code-assist bot commented Feb 13, 2026

Uh oh!

ryanaiagent commented Feb 19, 2026

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

lpezet Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

lpezet Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

lpezet Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

lpezet Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

ryanaiagent commented Feb 19, 2026

Uh oh!

lpezet commented Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments