Support for credentials parameter in ApigeeLlm #1743 - 5

[adk-bot]

5. Support for credentials parameter in ApigeeLlm

Doc file: docs/agents/models/apigee.md

Current state:

=== "Python"

```python

from google.adk.agents import LlmAgent
from google.adk.models.apigee_llm import ApigeeLlm

# Instantiate the ApigeeLlm wrapper
model = ApigeeLlm(
    # Specify the Apigee route to your model. For more info, check out the ApigeeLlm documentation (https://github.com/google/adk-python/tree/main/contributing/samples/hello_world_apigeellm).
    model="apigee/gemini-flash-latest",
    # The proxy URL of your deployed Apigee proxy including the base path
    proxy_url=f"https://{APIGEE_PROXY_URL}",
    # Pass necessary authentication/authorization headers (like an API key)
    custom_headers={"foo": "bar"}
)

Proposed Change:

=== "Python"

```python

from google.adk.agents import LlmAgent
from google.adk.models.apigee_llm import ApigeeLlm

# Instantiate the ApigeeLlm wrapper
model = ApigeeLlm(
    # Specify the Apigee route to your model. For more info, check out the ApigeeLlm documentation (https://github.com/google/adk-python/tree/main/contributing/samples/hello_world_apigeellm).
    model="apigee/gemini-flash-latest",
    # The proxy URL of your deployed Apigee proxy including the base path
    proxy_url=f"https://{APIGEE_PROXY_URL}",
    # Pass necessary authentication/authorization headers (like an API key)
    custom_headers={"foo": "bar"},
    # Optional: Pass google-auth credentials if the proxy requires additional OAuth scopes
    # credentials=my_credentials
)

Reasoning:
The ApigeeLlm python wrapper was updated to accept an optional credentials parameter to support passing explicit google-auth credentials (useful when the Apigee proxy requires additional OAuth scopes like userinfo.email for caller identification).

Reference: src/google/adk/models/apigee_llm.py

[netlify]

✅ Deploy Preview for adk-docs-preview ready!

Name	Link
🔨 Latest commit	337705d
🔍 Latest deploy log	https://app.netlify.com/projects/adk-docs-preview/deploys/6a3b0164939ffb0008a924cc
😎 Deploy Preview	https://deploy-preview-1750--adk-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[jcwriter74]

Doc file: docs/agents/models/apigee.md
Current state: >#1750
Other producers and consumers noting the same issue > google/adk-python#4721

Reasoning:
The ApigeeLlm python wrapper was updated to accept an optional credentials parameter to support passing explicit google-auth credentials (useful when the Apigee proxy requires additional OAuth scopes like userinfo.email for caller identification).

Follow-up:

• Originally suited for ADK v1.33.0 and later.
• More flexibility: allows for the Apigee model to expand the caller's capability of logging with the “credentials” parameter explicitly.
• It helps avoiding fragile and less ideal workarounds previously needed to use google/auth credentials in Gemini or Vortex LLMs.
• Previous to this solution proposal, monkey-patching to google.auth.default was necessary, making it cumbersome for producers and consumers to utilize.
• More custom API design products. Enhances enterprise and production environments' fitting.
• Chance to aggregate additional OAUth scopes, e.g., userinfo.email for identifying callers.
• Wider set of Apigee proxy authentication mechanisms, such as, the current version but adds the ability to integrate with Google's OAuth and IAM systems by optionally accepting google-auth credentials.

Conclusion: the current credentials snippet correctly addresses the ability of a producer or a consumer to add and integrate with Google's OAuth and IAM systems by optionally accepting google-auth credentials. Simple and precise.

Reference: src/google/adk/models/apigee_llm.py

[jcwriter74]

The update below defines the credentials component of the argument model, needed to initialize the ApigeeLlm backend

from google.adk.agents import LlmAgent
from google.adk.models.apigee_llm import ApigeeLlm


      **credentials:** As one of the components of the arg model for initializing the Apigee LLM backend, this field   represents optional google-auth credentials passed through to the
        underlying `genai.Client`. Use this when the Apigee proxy requires
        additional OAuth scopes for example, `userinfo.email` for tokeninfo-based
        caller identification). When omitted, the default `genai.Client`
        authentication flow is used.

"model "= ApigeeLlm(
    # Specify the Apigee route to your model. For more info, check out the  ApigeeLlm documentation (https://github.com/google/adk-python/tree/main/contributing/samples/hello_world_apigeellm).
    **model**="apigee/gemini-flash-latest",
    # The proxy URL of your deployed Apigee proxy including the base path
    **proxy_url**=f"https://{APIGEE_PROXY_URL}",
    # Pass necessary authentication/authorization headers (like an API key)
    **custom_headers**={"foo": "bar"},
    # (for instance, `userinfo.email` for tokeninfo-based caller identification)
    **credentials**: Optional google-auth credentials passed through to the
       underlying `genai.Client`. Use this when the Apigee proxy requires
       additional OAuth scopes. When omitted, the default `genai.Client` authentication flow is used.

    # credentials=my_credentials
)