Authenticate using 3-legged OAuth with auth manager

To grant your agent access to external tools and services (such as Jira tasks or GitHub repositories) on behalf of a specific end user, configure a 3-legged OAuth auth provider in the Agent Identity auth manager.

3-legged OAuth auth providers manage user redirection and tokens for you. This removes the need to write custom code to handle complex OAuth 2.0 flows.

3-legged OAuth workflow

3-legged OAuth auth providers require user consent because the agent accesses resources on behalf of the user.

  1. Prompt and redirection: The chat interface prompts the user to sign in and then redirects the user to the third-party application's consent page.
  2. Consent and storage: After the user grants permission, the Agent Identity auth manager stores the resulting OAuth tokens in a Google-managed credential vault.
  3. Injection: When you use the Agent Development Kit (ADK), the agent automatically retrieves the token from the auth provider and injects it into the tool invocation headers.

Before you begin

  1. Verify that you have chosen the correct authentication method.

  2. Enable the Agent Identity Connector API.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

  3. Create and deploy an agent.
  4. Ensure that you have a frontend application to handle user sign-in prompts and redirection to third-party consent pages.
  5. Verify that you have the roles required to complete this task.

Required roles

To get the permissions that you need to create and use a 3-legged auth provider, ask your administrator to grant you the following IAM roles on the project:

For more information about granting roles, see Manage access to projects, folders, and organizations.

These predefined roles contain the permissions required to create and use a 3-legged auth provider. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

The following permissions are required to create and use a 3-legged auth provider:

  • To create auth providers: iamconnectors.connectors.create
  • To use auth providers:
    • iamconnectors.connectors.retrieveCredentials
    • aiplatform.endpoints.predict
    • aiplatform.sessions.create

You might also be able to get these permissions with custom roles or other predefined roles.

Create a 3-legged auth provider

Create an auth provider to define the configuration and credentials for third-party applications.

To create a 3-legged auth provider, use the Google Cloud console or the Google Cloud CLI.

Console

  1. In the Google Cloud console, go to the Agent Registry page.

    Go to Agent Registry

  2. Click the name of the agent that you want to create an auth provider for.
  3. Click Identity.
  4. In the Auth Providers section, click Add auth provider.

  5. In the Add auth provider pane, enter a name and description.

    The name can contain only lowercase letters, numbers, or hyphens, cannot end with a hyphen, and must start with a lowercase letter.

  6. From the OAuth Type list, select OAuth (3 legged) .
  7. Click Create and continue.
  8. To grant your agent identity permission to use the auth provider, click Grant access.

    This automatically assigns the Connector User (roles/iamconnectors.user) role to the agent identity on the auth provider resource.

  9. Copy the callback URL.
  10. In a separate tab, register the callback URL on your third-party OAuth client application.
  11. In the Auth provider credentials section, enter the following information:
    • Client ID
    • Client Secret
    • Token URL
    • Authorization URL
  12. Click Add provider config.

The newly created auth provider appears in the Auth Providers list.

gcloud CLI

  1. Configure your OAuth client application to register your client and obtain a client ID and client secret. Specify the redirect URI using the template in that section.

  2. Create the auth provider using your client credentials:

    gcloud alpha agent-identity connectors create AUTH_PROVIDER_NAME \
    --project="PROJECT_ID" \
    --location="LOCATION" \
    --three-legged-oauth-client-id="CLIENT_ID" \
    --three-legged-oauth-client-secret="CLIENT_SECRET" \
    --three-legged-oauth-authorization-url="AUTHORIZATION_URL" \
    --three-legged-oauth-token-url="TOKEN_URL"
  3. Verify that your auth provider appears in the list and its state is ENABLED: 
    gcloud alpha agent-identity connectors list \
   --project="PROJECT_ID" \
   --location="LOCATION"

  4. Grant access permissions to allow your agent and local development environment to retrieve credentials from the auth provider. To allow your deployed agent and your personal user account to access the auth provider, grant the Connector User (roles/iamconnectors.user) role on the auth provider resource:

    1. Grant access to your deployed agent's SPIFFE ID (Agent Identity):

      gcloud alpha agent-identity connectors add-iam-policy-binding AUTH_PROVIDER_NAME \
    --project="PROJECT_ID" \
    --location="LOCATION" \
    --role="roles/iamconnectors.user" \
    --member="principal://agents.global.org-ORGANIZATION_ID.system.id.goog/resources/aiplatform/projects/PROJECT_NUMBER/locations/LOCATION/reasoningEngines/ENGINE_ID"

    2. Grant access to your personal user account for local development and testing (adk web):

      gcloud alpha agent-identity connectors add-iam-policy-binding AUTH_PROVIDER_NAME \
    --project="PROJECT_ID" \
    --location="LOCATION" \
    --role="roles/iamconnectors.user" \
    --member="user:USER_EMAIL"

Replace the following:

  • PROJECT_ID: Your Google Cloud project ID.
  • LOCATION: The location where your auth provider and agent are deployed (for example, us-west1).
  • AUTH_PROVIDER_NAME: The name for your auth provider (for example, bigquery-mcp-3lo-authprovider).
  • AUTHORIZATION_URL: The authorization server URL (for example, https://accounts.google.com/o/oauth2/v2/auth).
  • TOKEN_URL: The token server URL (for example, https://oauth2.googleapis.com/token).
  • CLIENT_ID: The OAuth client ID you generated from the third-party service.
  • CLIENT_SECRET: The OAuth client secret you generated from the third-party service.
  • ORGANIZATION_ID: Your Google Cloud organization ID.
  • PROJECT_NUMBER: Your Google Cloud project number.
  • ENGINE_ID: The ID of your deployed reasoning engine agent.
  • USER_EMAIL: Your personal user account email address.

Configure your OAuth client application

Before you register your OAuth client credentials, obtain a client ID and client secret from the third-party authorization server (for example, Google, GitHub, or Jira).

If you're connecting to a third-party service outside of Google Cloud, obtain the OAuth client credentials from that service's developer portal and skip the steps in this section.

Register the redirect URI

When you configure your OAuth client credentials, you must register the auth provider's dedicated callback redirect URI.

  1. Construct the redirect URI using the following template:

    https://iamconnectorcredentials.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/connectors/CONNECTOR_NAME/oauthcallback

    Replace the following:

    • PROJECT_ID: Your Google Cloud project ID.
    • LOCATION: The region where your auth provider will be deployed (for example,us-west1`).
    • CONNECTOR_NAME: The name of your auth provider.

    For example: https://iamconnectorcredentials.googleapis.com/v1/projects/my-project/locations/us-west1/connectors/bigquery-mcp-3lo-authprovider/oauthcallback

  2. If you're connecting to Google Cloud services (such as BigQuery), you can configure the consent screen and create OAuth client credentials in the Google Cloud console:

    1. Configure the OAuth consent screen:

      1. In the Google Cloud console, go to the APIs & Services >OAuth consent screen page.

        Go to APIs & Services >OAuth consent screen

      2. In the App information section, enter an application name (such as BigQuery Manager Application) and a support email.
      3. In the Audience section, select Internal or External.
      4. Enter your contact information to receive notifications.
      5. Read and accept the Google API Services User Data Policy.
      6. Click Finish.

    2. Create your OAuth client credentials:

      1. In the Google Cloud console, go to the APIs & Services >OAuth consent screen >Clients page.

        Go to APIs & Services >OAuth consent screen >Clients

      2. Click Create credentials >OAuth client ID.
      3. Select the Web application option from the list.
      4. Enter a recognizable name for your OAuth client.
      5. In the Authorized redirect URIs section, click Add URI and enter your constructed redirect URI.
      6. Click Create. In the OAuth client created dialog, copy your generated Client ID and Client Secret values.

Authenticate in your agent code

To authenticate your agent, you can use the ADK or call the Agent Identity API directly.

ADK

Reference the auth provider in your agent's code using the MCP toolset in the ADK.

from google.adk.agents.llm_agent import LlmAgent
from google.adk.auth.credential_manager import CredentialManager
from google.adk.integrations.agent_identity import GcpAuthProvider, GcpAuthProviderScheme
from google.adk.tools.mcp_tool.mcp_session_manager import StreamableHTTPConnectionParams
from google.adk.tools.mcp_tool.mcp_toolset import McpToolset
from google.adk.auth.auth_tool import AuthConfig

# Register the Google Cloud Auth Provider so the CredentialManager can use it.
CredentialManager.register_auth_provider(GcpAuthProvider())

# The URI to redirect the user to after consent is granted and the
# callback is received by the auth provider.
CONTINUE_URI = "https://YOUR_FRONTEND_URL/validateUserId"

# Create the Auth Provider scheme using the auth provider's full resource name.
auth_scheme = GcpAuthProviderScheme(
    name="projects/PROJECT_ID/locations/LOCATION/connectors/AUTH_PROVIDER_NAME",
    continue_uri=CONTINUE_URI
)

# Configure an MCP tool with the authentication scheme.
toolset = McpToolset(
    connection_params=StreamableHTTPConnectionParams(url="https://YOUR_MCP_SERVER_URL"),
    auth_scheme=auth_scheme,
)

# Initialize the agent with the authenticated tools.
agent = LlmAgent(
    name="AGENT_NAME",
    model="gemini-2.5-flash",
    instruction="AGENT_INSTRUCTIONS",
    tools