How to handle agent loop after 'adk_request_credential' is called?

[guilmour]

Hi everyone,

I'm running a multi-agent workflow using LoopAgent.

At some point, the agent calls an MCPToolset with authentication enabled. To handle the interactive OAuth/OIDC flow, I followed the documentation and used adk_request_credential, which correctly opens a popup window for the user to log in.

However, after the popup closes, the agent crashes with the following error:

RuntimeError: Attempted to exit cancel scope in a different task than it was entered in
ERROR:asyncio: an error occurred during closing of asynchronous generator

Does anyone know what might cause this issue?
Is it related to asyncio task handling or how the credential request is being awaited inside LoopAgent?

Any tips on debugging or properly integrating adk_request_credential in an async multi-agent setup would be greatly appreciated.

[adk-bot]

Response from ADK Answering Agent (experimental, answer may be inaccurate)

TLDR: The RuntimeError you're seeing is caused by an asyncio task conflict between the LoopAgent and the interactive credential request. The correct approach is to handle the authentication flow outside the agent's execution loop by pausing the agent when it requests credentials and then resuming it with the authentication details in a new run.

---

Hi there,

This is a great question. The issue you're encountering, RuntimeError: Attempted to exit cancel scope in a different task than it was entered in, is a known problem when dealing with asyncio tasks in complex agent loops, especially with older versions of Python.

The Cause

The LoopAgent runs its logic within a persistent asyncio task. When adk_request_credential is called, the underlying MCPToolset initiates an interactive authentication flow. This process can create a new task or use a different event loop context to handle the browser popup. This leads to a situation where the asyncio "cancel scope" is entered in the agent's main task but exited in the authentication task, causing the runtime error.

The Solution: Pause and Resume

Instead of handling the interactive flow from within the agent's continuous run, you should manage it from your client code that orchestrates the agent. The recommended pattern is to "pause" the agent execution to get user credentials and then "resume" it.

Here is the correct workflow:

1. Start the Agent: Initiate the agent run as you normally would, for example, using runner.run_async().

2. Listen for adk_request_credential: In your client code, iterate through the events yielded by the agent run. Watch for a Content block that contains a FunctionCall to adk_request_credential.

3. Pause Execution: When you detect this function call, stop iterating and exit the agent loop. The agent's state is now paused, waiting for the function's result.

4. Handle Authentication: Use the arguments from the adk_request_credential call to perform the interactive OAuth flow in your client. This is where the popup window should be handled.

5. Create a FunctionResponse: After the user successfully authenticates and your application receives the callback, package the results into a FunctionResponse content block.

6. Resume the Agent: Call runner.run_async() a second time. This time, pass the FunctionResponse block in the contents argument. The ADK runner will inject this response back into the agent, which will then have the credentials to proceed with its task.

This "pause and resume" cycle ensures that the interactive part happens outside the agent's asyncio task, preventing the conflict.

This pattern is the standard way to handle authentication in ADK, as detailed in the official documentation. You can find a complete implementation of this flow in the agent_cli.py example [2].

Following this approach should resolve the RuntimeError and allow your multi-agent workflow to handle authentication correctly.

[1] ADK Authentication Documentation: https://google.github.io/adk-docs/tools-custom/authentication/
[2] ADK Authentication Example (agent_cli.py): https://github.com/google/adk-docs/blob/main/examples/python/snippets/tools/auth/agent_cli.py

[guilmour]

Hi, @adk-bot, I’m using ADK Web, so I don’t explicitly instantiate a Runner myself.

Instead, I’m iterating through events inside a loop/stream handler:

 @ override
 async def _run_async_impl(self, ctx: InvocationContext) -> AsyncGenerator[Event, None]:

What would you suggest in this case?

[adk-bot]

Response from ADK Answering Agent (experimental, answer may be inaccurate)

TLDR: This is a known issue with asyncio task handling. Instead of letting the LoopAgent crash, you need to implement a client-side handler that detects the adk_request_credential event, pauses the agent, handles the OAuth flow, and then resumes the agent with the authentication credentials.

---

Hi @guilmour,

This is a great question. The RuntimeError: Attempted to exit cancel scope in a different task than it was entered in that you're seeing is a known issue related to how asyncio manages task cancellation, especially in scenarios involving interactive authentication flows within an agent loop. [1]

The Cause

The root of the problem is that the adk_request_credential function triggers an interactive OAuth/OIDC flow, which effectively pauses the agent's execution to wait for user input. When the popup closes, the agent's internal task management can get confused, leading to the cancel scope error you observed. This is particularly noticeable when using the MCPToolset. [2]

The Solution: Two-Phase Authentication Flow

To resolve this, you need to structure your application to explicitly manage the authentication lifecycle. This involves a two-phase process where your client code, which runs the agent, is responsible for handling the authentication request.

Here’s the recommended approach:

1. Run the Agent: Start your agent using runner.run_async().
2. Detect the Authentication Request: Your client code should loop through the events generated by the agent and check for a FunctionCall event where the function name is adk_request_credential. You can use a helper function like is_pending_auth_event for this. [3]
3. Pause and Handle User Input: Once the adk_request_credential event is detected, pause the agent's execution. Your application should then handle the interactive part of the OAuth flow (the popup window) and capture the callback URL containing the authorization code.
4. Resume the Agent: After the user authenticates, create a FunctionResponse that includes the authentication details. Then, call runner.run_async() again, passing this FunctionResponse to resume the agent's execution. The agent will then have the necessary credentials to proceed.

You can find a detailed explanation and code examples of this two-phase authentication flow in the ADK documentation. [3, 4, 5]

Following this pattern ensures that the asyncio event loop is managed correctly, preventing the RuntimeError and allowing your LoopAgent to handle authentication seamlessly.

I hope this helps you resolve the issue!

---

References

[1] https://github.com/google/adk-python/blob/main/src/google/adk/runners.py
[2] https://github.com/google/adk-python/blob/main/contributing/samples/mcp_toolset_auth/README.md
[3] https://google.github.io/adk-docs/tools-custom/authentication/
[4] https://github.com/google/adk-docs/blob/main/examples/python/snippets/tools/auth/agent_cli.py
[5] https://google.github.io/adk-docs/tools/google-cloud/mcp-toolbox-for-databases/