ADK authentication providers

The following articles describe how you can use custom authentication providers to let ADK agents authenticate users and act on their behalf:

• Gemini Enterprise delegated authorization (ADK) describes how to configure Gemini Enterprise and ADK agents to use delegated authorization.
• Gemini Enterprise delegated authorization (A2A) describes how to configure Gemini Enterprise and A2A agents built with the ADK to use delegated authorization.
• Microsoft Entra Agent ID on-behalf-of authorization describes how you can use Microsoft Entra Agent ID to manage access for an ADK agent, and let ADK agents access Google Cloud resources and other resources on behalf of Entra users.

The following articles describe how you can use custom authentication providers to let ADK agents authenticate to APIs and MCP servers on their own behalf:

• Cloud Run service authentication describes how to authenticate to APIs and MCP servers that run on Cloud Run and require service-to-service authentication.
• IAP service authentication describes how to authenticate to APIs and MCP servers that are protected by Identity-Aware-Proxy (IAP).
• Azure workload identity federation describes how to authenticate to Microsoft Azure by using workload identity federation.
• AWS federation describes how to authenticate to AWS by assuming a role using AssumeRoleWithWebIdentity.