Skip to content

feat(auth): Add native support for id_token in OAuth2 credentials #4402

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
anubhav756 wants to merge 4 commits into from
+25 −8
Closed

feat(auth): Add native support for id_token in OAuth2 credentials #4402

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
86b5948
feat(auth): Add native support for id_token in OAuth2 credentials
anubhav756 Feb 6, 2026
8536bc9
style(auth): remove trailing whitespace for pyink formatter in test s…
anubhav756 Feb 6, 2026
35c2987
style: fix trailing whitespace in test_oauth2_credential_util.py to s…
anubhav756 Feb 6, 2026
2784112
chore: delint
anubhav756 Feb 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/google/adk/auth/auth_credential.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,7 @@ class OAuth2Auth(BaseModelWithConfig):
auth_code: Optional[str] = None
access_token: Optional[str] = None
refresh_token: Optional[str] = None
id_token: Optional[str] = None
expires_at: Optional[int] = None
expires_in: Optional[int] = None
audience: Optional[str] = None
Expand Down
18 changes: 10 additions & 8 deletions src/google/adk/auth/oauth2_credential_util.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,11 +107,13 @@ def update_credential_with_tokens(
auth_credential: The authentication credential to update.
tokens: The OAuth2Token object containing new token information.
"""
auth_credential.oauth2.access_token = tokens.get("access_token")
auth_credential.oauth2.refresh_token = tokens.get("refresh_token")
auth_credential.oauth2.expires_at = (
int(tokens.get("expires_at")) if tokens.get("expires_at") else None
)
auth_credential.oauth2.expires_in = (
int(tokens.get("expires_in")) if tokens.get("expires_in") else None
)
if auth_credential.oauth2 and tokens:
auth_credential.oauth2.access_token = tokens.get("access_token")
auth_credential.oauth2.refresh_token = tokens.get("refresh_token")
auth_credential.oauth2.id_token = tokens.get("id_token")
auth_credential.oauth2.expires_at = (
int(tokens.get("expires_at")) if tokens.get("expires_at") else None
)
auth_credential.oauth2.expires_in = (
int(tokens.get("expires_in")) if tokens.get("expires_in") else None
Comment on lines +114 to +118
Copy link
Contributor

@gemini-code-assist gemini-code-assist bot Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

There's a subtle bug in the way expires_at and expires_in are handled. The current logic if tokens.get("...") will evaluate to False for a value of 0. While expires_in=0 might be rare, expires_at=0 (Unix epoch) is a valid timestamp. In this case, the value would be incorrectly stored as None instead of 0.

Additionally, this logic calls tokens.get(...) twice for each field.

To fix both issues, you can first get the value and then perform the check and conversion. This makes the code more robust and slightly more efficient.

    expires_at = tokens.get("expires_at")
    auth_credential.oauth2.expires_at = int(expires_at) if expires_at is not None else None

    expires_in = tokens.get("expires_in")
    auth_credential.oauth2.expires_in = int(expires_in) if expires_in is not None else None

)
14 changes: 14 additions & 0 deletions tests/unittests/auth/test_oauth2_credential_util.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,13 +222,27 @@ def test_update_credential_with_tokens(self):
tokens = OAuth2Token({
"access_token": "new_access_token",
"refresh_token": "new_refresh_token",
"id_token": "new_id_token",
"expires_at": expected_expires_at,
"expires_in": 3600,
})

assert credential.oauth2 is not None

update_credential_with_tokens(credential, tokens)

assert credential.oauth2.access_token == "new_access_token"
assert credential.oauth2.refresh_token == "new_refresh_token"
assert credential.oauth2.id_token == "new_id_token"
assert credential.oauth2.expires_at == expected_expires_at
assert credential.oauth2.expires_in == 3600

def test_update_credential_with_tokens_none(self) -> None:
credential = AuthCredential(
auth_type=AuthCredentialTypes.API_KEY,
)
tokens = OAuth2Token({"access_token": "new_access_token"})

# Should not raise any exceptions when oauth2 is None
update_credential_with_tokens(credential, tokens)
assert credential.oauth2 is None
Loading