Repository navigation
Tool authentication docs have no Go coverage of the auth package or MCP toolset auth #2372
Description
The Authenticating with Tools page is badged for Python only, and every example on it uses the Python AuthScheme and AuthCredential types, which do not exist in Go. The Remote MCP Authentication section of the MCP tools page has Python and TypeScript tabs only. ADK Go v2.5.0 authenticates outbound tool and MCP calls through the auth package, so Go developers who connect tools to protected services have nothing in the docs to start from. The only Go auth usage in the docs is one auth.StaticToken line in the Postman integration snippet. Code links below point to ADK Go v2.5.0.
Credential providers
auth.CredentialProvider resolves a credential for the current request. The package ships these providers: StaticToken (a fixed bearer token), APIKey (a key sent in a named header, such as X-Api-Key), TokenSourceProvider (any oauth2.TokenSource, which covers two-legged OAuth such as client credentials), ADC (Application Default Credentials, defaulting to the cloud-platform scope) and ServiceAccount with ServiceAccountConfig (an explicit JSON key or ADC, and a Google-signed ID token when Audience is set). ProviderFunc adapts a plain function. The credential types (BearerCredential, APIKeyCredential, BasicCredential, OAuth2Credential, and WithHeaders for extra headers) are in auth/credential.go.
This is the only supported way to authenticate a Go tool to a remote service. A provider that needs per-user credentials can read the acting user from the request context with agent.IdentityFromContext.
This belongs in a Go section of Authenticating with Tools. Documented for Python on the same page.
Applying credentials with auth.Transport and mcptoolset.Config.Auth
auth.Transport is an http.RoundTripper that resolves the provider on every request and applies the credential, so any http.Client used inside a tool can be authenticated. mcptoolset.Config.Auth takes a CredentialProvider and applies it to every outgoing MCP HTTP request. auth.CredentialStore, with the InMemoryCredentialStore implementation, caches credentials with an expiry for providers that fetch them over the network.
Remote MCP servers that require a token are the common case for Go MCP users. Config.Auth requires a streamable HTTP transport: with a stdio command transport, mcptoolset.New returns an error. The field comment also says not to set OAuthHandler on a supplied *mcp.StreamableClientTransport at the same time, because Auth overwrites the Authorization header.
This belongs in a Go tab of Remote MCP Authentication and resource access, which is documented for Python and TypeScript, and in the Go section of the authentication page.
No interactive OAuth consent in v2.5.0
The CredentialProvider doc comment says a provider that needs three-legged consent returns an error wrapping *ConsentRequiredError, and that "the tool layer turns that into a human-in-the-loop consent round-trip". In v2.5.0 no code outside the auth package handles ConsentRequiredError, so that round-trip does not happen. The interactive OAuth flow that the Python page describes, where the agent asks the user to sign in and resumes with the result, is not available in Go.
Go developers who read the code comment, or the Python OAuth walkthrough, will expect a consent prompt that never appears. Any Go docs text on tool authentication has to limit itself to non-interactive credentials until the round-trip exists.
This belongs in the same Go section of Authenticating with Tools.
- Document the
authcredential providers and credential types for Go - Document
auth.Transport,auth.CredentialStoreandmcptoolset.Config.Auth, including the streamable HTTP requirement - State that ADK Go v2.5.0 has no interactive OAuth consent round-trip
Activity