Repository navigation
BaseAuthenticatedTool saves invalid credentials #3016
Description
Is your feature request related to a problem? Please describe.
The BaseAuthenticatedTool run_async implementation obtains credentials from the tool context using the credential manager, which saves the credential for the session, before calling the tool implementation. This means that no future uses of the tool will ask for authentication, even if the user accidentally provided invalid credentials (such as an invalid username/password combo, or a token for a user account instead of an admin account).
This is problematic for automatic tool implementations like MCPTool and OpenAPITool. While a custom tool can remove the credentials from context if necessary (see https://google.github.io/adk-docs/tools/authentication/#authentication-logic-within-the-tool-function), these implementations don't allow a user to re-authenticate on failure.
Describe the solution you'd like
Some mechanism for removing credentials from the context when a tool responds with an unauthorized or forbidden error.
Activity
klateefa commentedon Nov 24, 2025
@BrennanThomasDISW Thank you for reporting this. I understand the request is currently under review. Please keep me posted if anything else is needed. Thanks for your patience.
Zamojski5 commentedon Sep 29, 2026
Looks the same on current main:
BaseAuthenticatedTool.run_asynconly requests a credential whenget_auth_credentialreturns nothing, and I don't see anything inbase_authenticated_tool.pythat drops it after a 401/403. So one bad token sticks for the whole session.I'd like to take this. Before writing code, which shape would you accept?
_run_async_implcan raise a dedicated auth error, the base class clears the stored credential and re-requests it.RestApiTool/McpToolhandle 401/403 themselves.I'd lean towards 1 so custom tools get it for free. Happy to go either way.
inamdarmihir commentedon Oct 26, 2026
I'd like to take this one. Proposal: when an authenticated tool (
BaseAuthenticatedToolsubclasses such as MCP and OpenAPI tools) gets an unauthorized/forbidden result for a credential it loaded from the credential service, drop that stored credential so the next call goes throughrequest_credentialagain, instead of reusing the rejected one forever. I'll keep it scoped to the 401/403 case onBaseAuthenticatedTooland add unit tests. If you'd prefer a different mechanism, tell me and I'll adjust.