Skip to content

Update DataAgentToolset credentials to use cloud-platform scope instead of bigquery #5030

@pemujo

Description

@pemujo

Description
The DataAgentToolset in the ADK is set to use the BigQuery scope by default (https://www.googleapis.com/auth/bigquery).
However, to successfully list and interact with data agents via the Data Analytics with Gemini API, the BigQuery scope is insufficient. When the agent is deployed to Vertex AI Agent Engine, this restriction causes unauthorized errors even if the attached Service Account has the correct IAM roles.

Steps to Reproduce:

  1. Use the DataAgentToolset to call list_accessible_data_agents.
  2. Deploy the agent to Vertex AI Agent Engine using the adk deploy agent_engine command.
  3. Observe the permission error in the Agent Engine Playground. (See screenshot)
Image

Expected Behavior:
The credentials should default to the https://www.googleapis.com/auth/cloud-platform scope because there is no specific scope for the Data Analytics with Gemini API.

Environment Details:

  • ADK Library Version: 1.27.4
  • Desktop OS: Linux / Vertex AI Agent Engine
  • Python Version: 3.10+

Model Information:

  • Are you using LiteLLM: No
  • Which model is being used: gemini-2.5-flash

How often has this issue occurred?:
Always (100%)


🟡 Optional Information

Current code (Line 20 on adk/tools/data_agent/credentials.py)

credentials, _ = google.auth.default(
scopes=["https://www.googleapis.com/auth/bigquery"]
)

Proposed Fix

credentials, _ = google.auth.default(
scopes=["https://www.googleapis.com/auth/cloud-platform"]
)

Metadata

Metadata

Assignees

No one assigned

    Labels

    tools[Component] This issue is related to tools

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions