feat(apigee): allow injecting credentials into ApigeeLlm by polar3130 · Pull Request #4722 · google/adk-python

polar3130 · 2026-03-05T14:31:03Z

Summary

Add an opt-in credentials: google.auth.credentials.Credentials | None parameter to ApigeeLlm.__init__.
When provided, the credentials are forwarded to the underlying genai.Client. When omitted, the credentials kwarg is not forwarded at all, so the default genai.Client auth flow is fully preserved (including avoiding the Gemini Developer API credentials warning).
Removed the previous internal google.auth.default() call and _APIGEE_SCOPES constant. The default auth mechanism is no longer modified by ApigeeLlm.
Callers needing additional OAuth scopes (e.g., userinfo.email for Apigee tokeninfo identification, the original ApigeeLlm: Add userinfo.email scope for Apigee Gateway tokeninfo user identification #4721 use case) can now construct credentials with their preferred scopes and inject them.

Test plan

Added unit test test_api_client_passes_credentials_when_provided verifying credentials are forwarded to genai.Client.
Added unit test test_api_client_omits_credentials_when_not_provided verifying the kwarg is not forwarded when unset.
All 57 tests in test_apigee_llm.py pass.

$ uv run --extra test python -m pytest tests/unittests/models/test_apigee_llm.py
======================== 57 passed, 2 warnings in 1.83s ========================

google-cla · 2026-03-05T14:31:20Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

adk-bot · 2026-03-05T14:32:02Z

Response from ADK Triaging Agent

Hello @polar3130, thank you for your contribution!

It looks like the Contributor License Agreement (CLA) check has failed. Before we can merge this PR, you'll need to sign the CLA. You can find more information in the "checks" section at the bottom of the pull request.

Thanks!

gemini-code-assist · 2026-03-05T14:32:44Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the ApigeeLlm client's authentication mechanism by explicitly requesting the userinfo.email scope alongside cloud-platform. This ensures that the Apigee Gateway can properly identify users through Google's tokeninfo API when service account key authentication is in use, improving security and traceability for API calls originating from Apigee. The change is isolated to the Apigee-specific LLM implementation, maintaining compatibility with other components.

Highlights

Authentication Scope Update: The ApigeeLlm.api_client method now explicitly requests cloud-platform and userinfo.email scopes when calling google.auth.default().
Credential Passing: The credentials obtained with the specified scopes are now passed to the genai.Client constructor.
Apigee Gateway User Identification: This change enables the Apigee Gateway to identify callers via Google's tokeninfo API when using Service Account key authentication, addressing issue ApigeeLlm: Add userinfo.email scope for Apigee Gateway tokeninfo user identification #4721.
Scope of Change: The modifications are limited to the ApigeeLlm class and do not affect the base Gemini class or the genai SDK.
New Unit Test: A new unit test, test_api_client_requests_userinfo_email_scope, was added to verify the correct scope usage and credential passing.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

src/google/adk/models/apigee_llm.py
- Imported the google.auth module.
- Defined a new constant _APIGEE_SCOPES containing the required authentication scopes.
- Modified the api_client method to obtain credentials using google.auth.default with the new scopes and pass these credentials to the genai.Client.
tests/unittests/models/test_apigee_llm.py
- Imported the _APIGEE_SCOPES constant for testing purposes.
- Added a new asynchronous unit test test_api_client_requests_userinfo_email_scope to verify that google.auth.default is called with the correct scopes and that the resulting credentials are passed to the genai.Client.

Activity

A new unit test test_api_client_requests_userinfo_email_scope was added to validate the new authentication scope behavior.
All 52 existing tests in test_apigee_llm.py were confirmed to pass after the changes.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

The pull request successfully implements the requested feature to add the userinfo.email scope for tokeninfo user identification in ApigeeLlm.api_client. The changes are well-contained within the ApigeeLlm class and do not impact other parts of the codebase. A new unit test has been added to verify the correct behavior, which is a good practice.

gemini-code-assist · 2026-03-05T14:34:16Z

+  assert 'https://www.googleapis.com/auth/userinfo.email' in _APIGEE_SCOPES
+  assert 'https://www.googleapis.com/auth/cloud-platform' in _APIGEE_SCOPES


These assertions are redundant. The test already verifies that mock_auth_default is called with _APIGEE_SCOPES on line 664. If the _APIGEE_SCOPES constant itself is incorrectly defined in apigee_llm.py, that would be a bug in the constant's definition, not in how it's used by api_client. Removing these lines will make the test more concise and focused on the behavior of api_client.

rohityan · 2026-03-12T22:12:39Z

Hi @polar3130 , Thank you for your contribution through this pull request! This PR has merge conflicts that require changes from your end. Could you please rebase your branch with the latest main branch to address these? Once this is complete, please let us know so we can proceed with the review.

ApigeeLlm now explicitly requests the userinfo.email OAuth scope alongside cloud-platform when creating credentials. This enables Apigee Gateway to identify callers via Google's tokeninfo API when using Service Account key authentication. Fixes google#4721

polar3130 · 2026-03-13T06:27:47Z

Hi @rohityan , Thanks for letting me know! I've rebased onto the latest main and resolved the conflict. Also addressed the review comment about redundant assertions in the test. Ready for review.

rohityan · 2026-03-18T00:04:34Z

Hi @polar3130 , please fix formatting errors. You can use autoformat.sh

polar3130 · 2026-03-18T02:15:50Z

Hi @rohityan , Thanks for the feedback! Fixed the formatting errors using autoformat.sh.

rohityan · 2026-03-20T18:45:33Z

Hi @polar3130 , can you fix the failing unit tests

Add autouse fixture to mock google.auth.default across all apigee_llm tests, preventing DefaultCredentialsError in CI environments without Application Default Credentials.

polar3130 · 2026-03-22T13:56:16Z

Hi @rohityan, I've fixed the failing unit tests. The issue was that google.auth.default() was not mocked in the existing tests, causing DefaultCredentialsError in CI environments without Application Default Credentials.

I added an autouse fixture to mock google.auth.default across all tests in the file. All 53 tests pass locally.

Could you approve the CI workflow run so the tests can be verified on CI as well? Thanks!

polar3130 · 2026-04-02T14:45:55Z

Hi @rohityan, friendly ping on this PR.
I believe all the requested changes have been addressed — fixed formatting via autoformat.sh and fixed failing unit tests with the autouse fixture. All 53 tests pass locally.
Could you approve the CI workflow run and proceed with the review when you get a chance?
Thanks for your time!

mdomingo22

Sorry about the delay.

I'd like to keep the default auth mechanisms as is. Can you instead modify the init to receive credentials: google.auth.credentials.Credentials | None = None and pass those along?

The underlying client, https://googleapis.github.io/python-genai/genai.html#genai.client.Client, warns about using credentials when using Gemini Developer API

Per reviewer feedback, drop the internal google.auth.default() call and the _APIGEE_SCOPES constant. Instead, expose an opt-in credentials parameter on ApigeeLlm.__init__ that is forwarded to genai.Client when provided. When omitted, the credentials kwarg is not forwarded at all, preserving the default genai.Client auth flow (and avoiding its Gemini Developer API warning about credentials usage). Callers needing additional OAuth scopes (e.g., userinfo.email for Apigee tokeninfo identification, the original google#4721 use case) can now construct credentials with their preferred scopes and inject them.

…rinfo-email-scope

polar3130 · 2026-04-30T01:36:17Z

Hi @mdomingo22, thanks for the feedback! I've updated the PR per your suggestion.

Changes

Removed the internal google.auth.default() call and _APIGEE_SCOPES constant — no more changes to the default auth flow.
Added a new credentials: google.auth.credentials.Credentials | None = None parameter to ApigeeLlm.__init__. When provided, it is passed through to genai.Client; when omitted, the credentials kwarg is not forwarded at all (so the default genai.Client auth path is fully preserved, and Gemini Developer API users won't see the credentials warning).
Updated tests:
- Added test_api_client_passes_credentials_when_provided — verifies pass-through.
- Added test_api_client_omits_credentials_when_not_provided — verifies the kwarg is not forwarded when unset.
- Removed the previous google.auth.default autouse mock since the SDK no longer calls it.

Users who need additional scopes (e.g., userinfo.email for Apigee tokeninfo, the original #4721 use case) can now construct credentials with their preferred scopes and inject them.

All 57 unit tests pass locally. Please take another look when you have a chance.

mdomingo22

Thanks for doing this

adk-bot added the models [Component] Issues related to model support label Mar 5, 2026

gemini-code-assist Bot reviewed Mar 5, 2026

View reviewed changes

polar3130 force-pushed the feat/apigee-llm-userinfo-email-scope branch from c412162 to 59c654f Compare March 5, 2026 14:49

rohityan self-assigned this Mar 9, 2026

rohityan added the request clarification [Status] The maintainer need clarification or more information from the author label Mar 12, 2026

polar3130 force-pushed the feat/apigee-llm-userinfo-email-scope branch from 59c654f to d79b22c Compare March 13, 2026 06:22

style: fix import order in apigee_llm.py via autoformat.sh

1b96b09

polar3130 force-pushed the feat/apigee-llm-userinfo-email-scope branch from 9770464 to 1b96b09 Compare March 18, 2026 02:11

Merge branch 'main' into feat/apigee-llm-userinfo-email-scope

873d22b

fix(apigee): mock google.auth.default in unit tests to fix CI failures

0f0dc70

Add autouse fixture to mock google.auth.default across all apigee_llm tests, preventing DefaultCredentialsError in CI environments without Application Default Credentials.

Merge branch 'main' into feat/apigee-llm-userinfo-email-scope

1d6e9b0

mdomingo22 suggested changes Apr 29, 2026

View reviewed changes

polar3130 added 2 commits April 30, 2026 09:59

Merge remote-tracking branch 'upstream/main' into feat/apigee-llm-use…

f746117

…rinfo-email-scope

polar3130 changed the title ~~feat(apigee): add userinfo.email scope for tokeninfo user identification~~ feat(apigee): allow injecting credentials into ApigeeLlm Apr 30, 2026

mdomingo22 approved these changes Apr 30, 2026

View reviewed changes

xuanyang15 self-assigned this Apr 30, 2026

		assert 'https://www.googleapis.com/auth/userinfo.email' in _APIGEE_SCOPES
		assert 'https://www.googleapis.com/auth/cloud-platform' in _APIGEE_SCOPES

Conversation

polar3130 commented Mar 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

google-cla Bot commented Mar 5, 2026

Uh oh!

adk-bot commented Mar 5, 2026

Uh oh!

gemini-code-assist Bot commented Mar 5, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

rohityan commented Mar 12, 2026

Uh oh!

polar3130 commented Mar 13, 2026

Uh oh!

rohityan commented Mar 18, 2026

Uh oh!

polar3130 commented Mar 18, 2026

Uh oh!

rohityan commented Mar 20, 2026

Uh oh!

polar3130 commented Mar 22, 2026

Uh oh!

polar3130 commented Apr 2, 2026

Uh oh!

mdomingo22 left a comment

Choose a reason for hiding this comment

Uh oh!

polar3130 commented Apr 30, 2026

Uh oh!

mdomingo22 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

polar3130 commented Mar 5, 2026 •

edited

Loading