Document ID token authentication for service accounts (#1350 - 8)#1875
Conversation
✅ Deploy Preview for adk-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
joefernandez
left a comment
joefernandez
left a comment
There was a problem hiding this comment.
some teaching flow issues and style/mechanical issues to look at, here
|
FYI the new failing link checker CI is due to a different HTTP status code coming from one of Atlassian's websites, unrelated to this PR. I'll fix that in a separate PR shortly. |
koverholt
left a comment
koverholt
left a comment
There was a problem hiding this comment.
Thanks for the updates! I verified the ServiceAccount API against adk-python and the core is correct: the params, the audience-required-when-use_id_token validation, and the Cloud Run/Functions purpose all check out.
I left inline comments for the fixes needed before merge. Once those are in I can re-review.
koverholt
changed the title
koverholt
left a comment
koverholt
left a comment
There was a problem hiding this comment.
Thanks for the edits and working through all of the comments. The updated content LGTM, merging.
3 participants
Documents ID token support for service-account authentication, needed when an agent calls IAM-restricted services such as private Cloud Run or Cloud Functions. Adds a "Use ID token" section under "Configure tools with authentication" in the Tool Authentication guide, with an end-to-end OpenAPIToolset example, the ServiceAccount config parameters, and troubleshooting tips.
Rendered preview: https://deploy-preview-1875--adk-docs-preview.netlify.app/tools-custom/authentication/#use-id-token
Original Issue: #1350 (see item 8)
Original adk-bot PR: #1365. This PR supersedes #1365 (adk-bot's auto-generated draft, which used a helper signature that doesn't exist); it uses the actual
ServiceAccountAPI instead, so #1365 can be closed.