Keep the token in callback state for the duration of the check, then clear it. The client secret stays in the process that minted the token. Do not put either value in AuthCredential. That type is how a tool calls some other API.
The exchange is in Agent frameworks.
Which credential
| Credential | Use it when |
|---|---|
| Agent identity | A named agent inside a project that already has users. Agents is sales-gated until access is approved. |
| M2M application | The caller is a job, or Agents access is not approved yet. Same client_credentials grant. |
| Personal access token | One person's script. Keep it off an unattended caller. |
| Service account | Authdog REST automation. Not the bearer this hook checks. |
To act for a person, keep this hook and present an RFC 8693 token. sub stays the user. act names the agent. The planned sample uses a token whose subject is the agent.
Related
| Read | To learn how to |
|---|---|
| Custom channel auth for Google ADK | Refuse a missing bearer |
| Machine identity | Choose the credential |
| Google ADK | See the hook |