Skip to content

Update DataAgentToolset credentials to use cloud-platform scope instead of bigquery #5030

@pemujo

Description

@pemujo

Description
The DataAgentToolset in the ADK is set to use the BigQuery scope by default (https://www.googleapis.com/auth/bigquery).
However, to successfully list and interact with data agents via the Data Analytics with Gemini API, the BigQuery scope is insufficient. When the agent is deployed to Vertex AI Agent Engine, this restriction causes unauthorized errors even if the attached Service Account has the correct IAM roles.

Steps to Reproduce:

  1. Use the DataAgentToolset to call list_accessible_data_agents.
  2. Deploy the agent to Vertex AI Agent Engine using the adk deploy agent_engine command.
  3. Observe the permission error in the Agent Engine Playground. (See screenshot)
Image

Expected Behavior:
The credentials should default to the https://www.googleapis.com/auth/cloud-platform scope because there is no specific scope for the Data Analytics with Gemini API.

Environment Details:

  • ADK Library Version: 1.27.4
  • Desktop OS: Linux / Vertex AI Agent Engine
  • Python Version: 3.10+

Model Information:

  • Are you using LiteLLM: No
  • Which model is being used: gemini-2.5-flash

How often has this issue occurred?:
Always (100%)


🟡 Optional Information

Current code (Line 20 on adk/tools/data_agent/credentials.py)

credentials, _ = google.auth.default(
scopes=["https://www.googleapis.com/auth/bigquery"]
)

Proposed Fix

credentials, _ = google.auth.default(
scopes=["https://www.googleapis.com/auth/cloud-platform"]
)

Metadata

Metadata

Assignees

Labels

tools[Component] This issue is related to tools

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions