# Practical and Useful Patterns with ADK 🔐 API Keys, Bearer Tokens, OAuth2, OpenID Connect, Service Accounts — ADK's Authentication seamlessly integrates any auth scheme into your tools. 📌 Title: Authentication — Tool Auth Integration 🔗 URL: 🧩 Overview ADK's Authentication consists of two components: AuthScheme and AuthCredential. It supports APIKey, HTTP Bearer, OAuth2, OpenID Connect, and SERVICE_ACCOUNT authentication methods, providing unified auth management across tools. OAuth2 supports browser flows, and `tool_context.state` enables token caching and expiry handling. 🛠 Usage Configuration examples for each authentication method. Import `AuthScheme`, `AuthCredential`, `APIKeyAuth`, `HTTPBearerAuth`, and `OAuth2Auth` from `google.adk.auth`. For API Key authentication, create `APIKeyAuth(header_name="X-API-Key")` as the scheme and `AuthCredential(api_key="sk-your-api-key")` as the credential. For HTTP Bearer authentication, use `HTTPBearerAuth()` with `AuthCredential(token="your-bearer-token")`. For OAuth2 (browser flow), define the scheme with `OAuth2Auth(authorization_url="", token_url="", scopes=["read", "write"])` and provide `AuthCredential(client_id="your-client-id", client_secret="your-client-secret")`. Using authentication in tools: For using authentication in tools, define `call_protected_api(endpoint: str, tool_context: ToolContext)`. Retrieve cached tokens via `tool_context.state.get("user:api_token")` and reuse them if not expired. When expired, call `refresh_token(tool_context)` for a new token and store it back in `tool_context.state["user:api_token"]` for caching. Use the token in an `Authorization: Bearer` header when making API requests. 🏗 Practical Patterns **Token Caching Strategy**: Use the `user:` prefix in `tool_context.state` to cache tokens within a user's session, avoiding redundant token fetches. Always implement expiry management. For token caching, define `get_or_refresh_token(tool_context: ToolContext) -> str`. Retrieve token data from `tool_context.state.get("user:oauth_token")` and check the `expires_at` field with a 60-second buffer. If the token is still valid, return the `access_token` directly. Otherwise, call `oauth_client.refresh(refresh_token=...)` to obtain a new token and store it in `tool_context.state["user:oauth_token"]` as a dictionary containing `access_token`, `refresh_token`, and `expires_at`. **Service Account Authentication**: For GCP service-to-service communication, SERVICE_ACCOUNT auth enables secure API calls without user intervention. **Multi-Layer Auth**: When using different auth methods within the same agent, configure auth per tool. Combining with OpenAPIToolset's `auth_scheme`/`auth_credential` is particularly effective. 💡 Use Cases 🔑 Third-party API authentication with API keys 🌐 User-delegated API operations via OAuth2 🏗️ GCP inter-service communication with service accounts 🔄 Token caching and automatic refresh ⚠️ Caveats - Never hardcode credentials (API keys, secrets). Retrieve from environment variables or Secret Manager. - OAuth2 browser flows don't work in server-side batch processing. Consider service accounts or client credentials flow instead. - Neglecting token expiry management leads to 401 errors from expired tokens. Implement automatic refresh with a time buffer. ✨ With properly configured ADK authentication, you can seamlessly embed secure API integration into your tools. Authentication is the foundation of agent trustworthiness! #ADK# #AIAgent#

Ever wondered how physical coin flips and dice rolls become a Bitcoin BIP39 mnemonic? Explore entropy, 11-bit word indexes, checksum generation, and the possible final words, step by step. ⚠️ Educational use only. Never use an online-generated seed to receive real funds. For real wallets, work offline in a secure environment, and store physical backups of your seed phrase and passphrase separately. Try it here:

The operations in weight loading can vary a LOT across models and layers. To support these, we use a “recording tensor” dry run - we use a dummy tensor to record the various transformations in the `load_weights` function, and store the op chain at init time. We replay the op chain on the trainer side to compute the full weights during each weight sync.

Apple officially announced new commercial terms for EU apps. CTF is cancelled and replaced with a 5% Core Technology Commission. Initial Acquisition Fee and Store Services Fee are also dropped. Apps can now offer Apple IAP and other payment methods at the same time. Takes effect October 1, 2026. 👉

Europe doesn't have an energy shortage. It has a coordination problem. Millions of homes generate and store power that mostly sits idle. We're proud to lead @nomosenergy's €20M round – backing the team building the operating system for Europe's energy transition, one home at a time.

Some LC-36 updates. Now that we’ve had access to the pad and integration facility we can share a bit of good news. The propellant farm, oxygen, liquid hydrogen and LNG tanks are all in good shape. This is good luck because these are very long lead items. The water tower is also good. The big support tower is damaged, but it can be repaired in place rather than torn down and replaced. The booster “Never Tell Me The Odds” and the three GS-2s that were onsite in the integration facility also look good. I’ve seen some speculation that we might move directly to the 9x4 configuration, but we won’t do that. Rate manufacturing of 7x2 is going well, and we’re going to continue that at pace as planned and store the stages for use. In addition, we had already been working for some time on eliminating our transporter-erector in favor of an alternative vertical conop, and we’ll now go directly to that; so we don’t need a new transporter-erector. We will fly again before the end of this year. Gradatim Ferociter.