Enable the agent's APIs, see its scopes

source scripts/config.sh config/12-1-agents-dans-projet-exp.env
./scripts/deployer_shell.sh oauth {{K}}

== courriels
▶ gcloud services enable gmail.googleapis.com --project={{PROJET_AGENTS}}
  portées (A2A)           : https://www.googleapis.com/auth/gmail.readonly
  portées (Agent Runtime) : … + https://www.googleapis.com/auth/cloud-platform
Client OAuth (une fois, console, 2 min) : https://console.cloud.google.com/auth/clients?project={{PROJET_AGENTS}}

APIs and scopes come from the agent's "oauth" block in catalogue.json.

The OAuth client

1. 🔎 Google Auth Platform → if needed Get started: app name, email, audience Internal.
2. Clients → + Create client → Web application → name ge-{{K}}.
3. Authorized redirect URIs, exactly these two:

https://vertexaisearch.cloud.google.com/oauth-redirect
https://vertexaisearch.cloud.google.com/static/oauth/oauth.html

→ Create → note the client ID (put it in “Your values”) and the secret. Never put them in the repository.

Deploy the agent with its authorization

AGENTS_OAUTH="{{K}}={{AUTH}}" ./scripts/deployer_shell.sh cloudrun {{K}}
./scripts/deployer_shell.sh tester {{K}}   # 3 to 5 min later: “cliquez sur Autoriser” = expected

The agent gets AUTH_ID={{AUTH}}. In A2A, the authorization name in the app may differ; on Agent Runtime it must be identical.

The sheet, with the full authorization URL

AGENTS_OAUTH="{{K}}={{AUTH}}" CLIENT_ID={{CLIENT_ID}} ./scripts/deployer_shell.sh carte {{K}}

  3. Authentication (ne PAS cliquer Skip) :
      Nom de l'autorisation  : {{AUTH}}
      Authorization URL      : {{AUTH_URL}}
      Token URL              : https://oauth2.googleapis.com/token
      Scopes                 : {{SCOPES}}
      PKCE / HTTP Basic      : décochés

The app's permission on the service

Permission ① on {{K}}-a2a-shell, as for any A2A agent (tab 2).

Add the agent with the authorization

Console: Custom agent via A2A → the card → Authentication: fill in the fields from the sheet. Do not click Skip.

Or by script, with the app values passed in front of the commands (the config file is not touched):

export PROJET_APP={{PROJET_APP}} NUM_APP={{NUM_APP}} GE_LOCATION={{GE_LOCATION}}
export GE_PROJECT={{PROJET_APP}} GE_APP={{APP_ID}}
./scripts/autorisation_oauth.sh create {{AUTH}} ~/Downloads/client_secret_XXX.json "{{SCOPES}}" "{{NOM}}"
AUTH_ID={{AUTH}} ./scripts/add_agent_to_ge.sh a2a carte-{{K}}.json "{{NOM}} (A2A)"   # + run.invoker permission
./scripts/personnaliser_agent.sh "{{NOM}} (A2A)" {{K}}                              # suggested questions, language

The test

Agent User for you → open the agent → “{{EX}}” → Authorize box → Google window → Allow → the answer, with your data. After that, no more box: access is kept.

The Atlassian OAuth app

1. developer.atlassian.com/console/myapps → Create → OAuth 2.0 integration.
2. Permissions: Jira API (read:jira-work, read:jira-user), Confluence API (search:confluence, read:confluence-content.summary).
3. Authorization → Callback URL: https://vertexaisearch.cloud.google.com/static/oauth/oauth.html.
4. Settings: Client ID and Secret. Distribution → Sharing: otherwise only you can authorize.

Deploy on Agent Runtime with both authorizations

AGENTS_OAUTH="workspace=acces-google,acces-atlassian" ./scripts/deployer_shell.sh runtime workspace
AGENTS_OAUTH="workspace=acces-google,acces-atlassian" CLIENT_ID={{CLIENT_ID}} ./scripts/deployer_shell.sh carte workspace

In the app: two authorizations

Custom agent via Agent Runtime → Authorizations → Add authorization twice. The names must be identical to AGENTS_OAUTH.

By script: AUTH_ID=acces-google,acces-atlassian ./scripts/add_agent_to_ge.sh adk <path> "Espace de travail". In A2A, the script refuses: “UNE seule autorisation par agent”.

In the chat

“My open Jira tickets?” → a second Authorize button (Atlassian) → Accept → the list. “Prepare my week with meetings, emails and tickets” → all three sources in one answer.

The Google window (no risk)

OAuth client's project → 🔎 Google Auth Platform → Branding: name (“Assistant Acme”), 120×120 PNG logo, team email. Then Data access → declare the scopes: they show in plain words.

The authorization name

export PROJET_APP={{PROJET_APP}} NUM_APP={{NUM_APP}} GE_LOCATION={{GE_LOCATION}}
./scripts/autorisation_oauth.sh list                              # ID | display name
./scripts/autorisation_oauth.sh renommer {{AUTH}} "{{NOM}}"

If the box still shows the ID after renaming, recreate the authorization with a readable ID, then reattach the agent.

The agent: name, questions, placeholder, language, icon

GE_PROJECT={{PROJET_APP}} GE_APP={{APP_ID}} GE_LOCATION={{GE_LOCATION}} \
  ./scripts/personnaliser_agent.sh "<current name in the app>" {{K}} --icone icone.png

AVANT : {"displayName": "test gmail remote agent with auth"}
APRÈS : {"displayName": "{{NOM}} (A2A)", "starterPrompts": [{"text": "{{EX}}"}, …], "languageCode": "fr"}
Modifier cet agent dans l'app {{APP_ID}} (projet {{PROJET_APP}}) ? Tapez « oui » : oui
modifié : …  (retour arrière : ./scripts/personnaliser_agent.sh --annuler avant-<ID>.json)

Only these fields change (updateMask): neither the card nor the authorization.