ApplicationIntegrationToolset oauth

Hi All,

I’ve been testing out agent development using an ApplicationIntegrationToolset and Integration connector for gemini enterprise and have been having issues with oauth. When i run the agent locally with adk web everything works exactly as i expect it to but when i publish it to agent engine and add it into gemini enterprise the oauth workflow doesn’t seem to run correctly. The popup to grant authorization never renders/opens when uploaded. I built out the example google calendar agent for testing and sanity checking and its behaving exactly like my agent. See example code below:

agent.py

from google.adk.agents.llm_agent import Agent
from .calendar import connector_tool


root_agent = Agent(
    model='gemini-2.5-flash',
    name='Calendar_agent_test',
    description='A helpful assistant for interacting with Calendar.',
    instruction="""Interact with Calendar using this Agent""",
    tools=[connector_tool]
)

calendar.py

from google.adk.tools.application_integration_tool.application_integration_toolset import ApplicationIntegrationToolset
from google.adk.tools.openapi_tool.auth.auth_helpers import dict_to_auth_scheme
from google.adk.auth import AuthCredential, AuthCredentialTypes, OAuth2Auth
from fastapi.openapi.models import OAuth2, OAuthFlowAuthorizationCode, OAuthFlows



project_id = <project-id>

auth_scheme = OAuth2(
    flows=OAuthFlows(
        authorizationCode=OAuthFlowAuthorizationCode(
            authorizationUrl="https://accounts.google.com/o/oauth2/auth",
            tokenUrl="https://oauth2.googleapis.com/token",
            scopes={
              "https://www.googleapis.com/auth/cloud-platform": "View and manage your data across Google Cloud Platform services",
              "https://www.googleapis.com/auth/calendar.readonly": "View your calendars"
            },
        )
    )
)

auth_credential = AuthCredential(
  auth_type=AuthCredentialTypes.OAUTH2,
  oauth2=OAuth2Auth(
      client_id=<client-id>,
      client_secret=<client-secret>, 
  ),
)

connector_tool = ApplicationIntegrationToolset(
    project=project_id,
    location="us-central1", 
    connection="test-calendar",
    entity_operations={
        "AllCalendars":["GET","LIST", "CREATE", "UPDATE"],
        "Calendars": ["GET","LIST", "CREATE", "UPDATE"],
    },
    actions=["ListCalendarEvents","GetCalendarEvent"], #replace with actions. this one is for list events
    tool_name_prefix="calendar",
    tool_instructions="use this tool to query your google calendar",
    auth_scheme=auth_scheme,
    auth_credential=auth_credential
)

If anyone has a suggestion on how to get the authorization window to open once the agent is uploaded into agent engine and added into gemini enterprise it would be much appreciated!

Edit: Adding a screenshot for clarity of what isn’t working. The box in the red square doesn’t render/open once the same agent is uploaded to agent engine and added to gemini enterprise. This one is from a Jira agent but it’s the same behavior with any agent using oauth including the example above.

Hi @scuffe_cdw, welcome to the forum :slight_smile:

We’ll keep your question on the radar to ensure it gets noticed and encourage the community to share their thoughts. In the meantime, feel free to check out the curated content from Googlers in the Knowledge Hub and on-demand videos.

Hi Spencer, thanks for the question. There is a difference in how/what manages the OAuth flow when running it locally in adk web vs when deployed and surfaced up in Gemini Enterprise via Agent Engine.

Gemini Enterprise manages it’s own OAuth config and the access tokens when they are minted.

The workaround for the moment is to use a before tool callback to retrieve the access token which is now managed in Gemini Enterprise. Once you have the token, you can inject it for the connector tool call.

Putting it all together you should be able to use the example code (incomplete) below.

DYNAMIC_AUTH_PARAM_NAME = "dynamic_auth_config" # Name of the parameter to inject
DYNAMIC_AUTH_INTERNAL_KEY = "oauth2_auth_code_flow.access_token" # Internal key for the token
AUTH_ID = "ge-auth-id"

def inject_auth_token(callback_context, tool):
    # auth_id is your OAuth resource you created for Gemini Enterprise https://docs.cloud.google.com/gemini/enterprise/docs/register-and-manage-an-adk-agent#add-authorization-resource
    auth_id = AUTH_ID
    access_token = callback_context.state.get(auth_id)
    if access_token:
        dynamic_auth_config = {DYNAMIC_AUTH_INTERNAL_KEY: access_token}
        args[DYNAMIC_AUTH_PARAM_NAME] = json.dumps(dynamic_auth_config)
    return None

sfdc_connector_tool = ApplicationIntegrationToolset(
    project=CONNECTION_PROJECT_ID, 
    location=CONNECTION_REGION, 
    connection=CONNECTION_NAME,
    tool_name_prefix="sfdc_tool",
    entity_operations={
        "Account": ["GET", "LIST"],
    },
    tool_instructions=TOOL_INSTR,
)

root_agent = Agent(
    model='gemini-2.5-flash',
    name='salesforce_agent',
    description="SalesForce Agent to get details on accounts and contacts.",
    instruction=ROOT_AGENT_INSTR,
    tools= [sfdc_connector_tool],
    # before_tool_callback=[inject_auth_token]
)

This is a workaround for the moment. There are some upcoming changes/fixes which will make this more streamlined. Ref: ApplicationIntegrationToolset not picking up Gemini Enterprise Authorization · Issue #4553 · google/adk-python · GitHub

HTH

Hi,

Is there any new update documentation on this topic, as far as I understood the latest ADK version has addressed this, but detail how to setup the ApplicationIntegrationToolset is not there.

My case is a bit different: I have created a data connector in Gemini App and now i would like to enable the AIT for that connector in our custom agent built in adk and deployed to agent runtime that registered in Gemini App.

Thanks

Hi @lee_198,

To address both your questions regarding the recent ADK update and connecting tools to Gemini Enterprise:

1. Clarification: Gemini Enterprise Data Connectors vs. GCP Integration Connectors

It is important to differentiate between the two types of connectors:

  • Gemini Enterprise Data Connectors (configured in the Gemini Enterprise App console): These are designed for Enterprise Search and Grounding (RAG) within the Assistant UI. They are not currently exposed as runnable tools that a custom ADK agent deployed to Agent Engine can invoke.
  • GCP Integration Connectors (Application Integration): These are provisioned in Google Cloud Platform (connectors.googleapis.com) in your GCP Project and Region. ApplicationIntegrationToolset targets these GCP resources.

If you want your custom ADK agent to execute actions against a backend service (such as Salesforce, Jira, or Google Calendar), you need to provision the connector as an Integration Connector in GCP and make sure Authentication Override (authOverrideEnabled) is enabled on the connector if you plan to pass user-level OAuth tokens.

2. How the Latest ADK Update Simplifies OAuth (credential_key)

In earlier ADK versions, developers had to use a before_tool_callback to manually retrieve the token minted by Gemini Enterprise and inject dynamic_auth_config (as referenced in GitHub Issue 4553).

In recent ADK versions, this has been streamlined:

ApplicationIntegrationToolset now accepts a credential_key parameter. When configured, ADK automatically looks up the OAuth token from session state using this key, exchanges it, and injects it into the connector tool call under dynamic_auth_config without requiring any manual callbacks.

3. Setup and Code Example

-Step A: Configure Authorization Resource in Gemini Enterprise

  • In the Gemini Enterprise console, set up an Authorization Resource (OAuth 2.0) with your provider client ID, client secret, auth URL, token URL, and required scopes.
  • Note the Authorization Resource ID (for example: my-oauth-auth-id).
  • Associate this Authorization Resource with your custom agent when registering it in Gemini Enterprise.

(Reference: Register and manage ADK agents hosted on Agent Runtime  |  Gemini Enterprise  |  Google Cloud Documentation )

-Step B: Define your ADK Agent using credential_key

Pass the Authorization Resource ID as credential_key directly to ApplicationIntegrationToolset:

from google.adk.agents.llm_agent import Agent

from google.adk.tools.application_integration_tool.application_integration_toolset import ApplicationIntegrationToolset

PROJECT_ID = "your-gcp-project"

REGION = "us-central1"

CONNECTION_NAME = "your-gcp-connection-name"

AUTH_RESOURCE_ID = "my-oauth-auth-id"

connector_toolset = ApplicationIntegrationToolset(

    project=PROJECT_ID,

    location=REGION,

    connection=CONNECTION_NAME,

    entity_operations={

        "Account": ["GET", "LIST"],

    },

    tool_name_prefix="crm",

    tool_instructions="Use this tool to read and query CRM data.",

    credential_key=AUTH_RESOURCE_ID,

)

root_agent = Agent(

    model="gemini-2.5-flash",

    name="crm_agent",

    description="Agent for querying CRM data via Integration Connectors.",

    instruction="Help users interact with CRM records using the provided tools.",

    tools=[connector_toolset],

)

Step C: Deploy and Test

1. Deploy your agent to Vertex AI Agent Engine / Agent Runtime and register it in your Gemini Enterprise App.

2. When an end user prompts the agent, Gemini Enterprise prompts the user for consent via the OAuth popup and stores the minted token under AUTH_RESOURCE_ID.

3. ApplicationIntegrationToolset detects credential_key, automatically retrieves the token, and passes it along with the connector execution request.

Hope this clears up the setup! Let us know if you hit any roadblocks.-