BigQueryCredentialsConfig fails to refresh

[flooreigenhuisgoogle]

** Please make sure you read the contribution guide and file the issues in the right place. **
Contribution guide.

Describe the bug
When we deploy an agent to Agent Engine with the BigQueryToolset AND BigQueryCredentialsConfig like in the docs, with a service account attached to it, initially it works, confirmed it has access to BigQuery. After 12 hrs or so, it loses access to BigQuery as if the token is not refreshed. We request the credentials through application default credentials.

When we deploy without the BigQueryCredentialsConfig in the BigQueryToolSet it works fine, even after a longer period of time.

To Reproduce
Deploy a simple agent, like so: https://google.github.io/adk-docs/tools/built-in-tools/#bigquery. Attach a custom service account to it with proper BQ permissions.

Deploy it to Agent Engine. Query it with any question that triggers any tool in the BQ toolset. Confirm it works. Wait until the next day. Query it again with the same question and confirm it doesn't work.

The agent the next day returns with tool call adk_request_credential.

Expected behavior
It will respond in a similar fashion.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: [e.g. macOS, Linux, Windows]: Agent Engine, querying from MacOS
• Python version(python -V): 3.13.7
• ADK version(pip show google-adk): 1.14.0

Model Information:

• Are you using LiteLLM: No
• Which model is being used(e.g. gemini-2.5-pro): gemini-2.5-pro & gemini-2.5-flash

Additional context
When I update the agent with the BigQueryCredentialsConfig the next day, keeping all the code the same, with the same service account, it works again

[Yorko]

Got the same issue, used the snippet from the docs:

# Define a credentials config - in this example we are using application default
# credentials
# https://cloud.google.com/docs/authentication/provide-credentials-adc
application_default_credentials, _ = google.auth.default()
credentials_config = BigQueryCredentialsConfig(
 credentials=application_default_credentials
)
# Instantiate a BigQuery toolset
bigquery_toolset = BigQueryToolset(
 credentials_config=credentials_config, bigquery_tool_config=tool_config
)

In this setup the agent loses access to bigquery in ~12 hours/

Dropping credentials_config fixed it.

bigquery_toolset = BigQueryToolset(bigquery_tool_config=tool_config)

The custom service account roles are:

• BigQuery Data Viewer
• BigQuery Job User
• Cloud Trace Agent
• Logs Writer
• Service Usage Consumer
• Vertex AI User

[shobsi]

Took a quick look:

The credential refresh should happen here:

adk-python/src/google/adk/tools/_google_credentials.py

Line 172 in 632bf8b

creds.refresh(Request())

but for non-oauth credentials types it returns earlier:

adk-python/src/google/adk/tools/_google_credentials.py

Line 163 in 632bf8b

return creds

In the Agent Engine deployment I would think the credentials are of type google.auth.compute_engine.credentials.Credentials, so the latter applies, and not-refreshed credentials fed to the BigQuery client through the BigQuery tools.

adk-python/src/google/adk/tools/bigquery/query_tool.py

Line 99 in 632bf8b

credentials=credentials,

However, this should not be an issue, as the BigQuery client itself does credentials refresh internally.

Here is a quick demo in Colab:

## Authenticate 
from google.colab import auth
auth.authenticate_user()

## Check application default credentials are invalid by default
import google.auth

application_default_credentials, _ = google.auth.default()
application_default_credentials.valid

> False

## Check the credential type

type(application_default_credentials)

> google.auth.compute_engine.credentials.Credentials

## Show that they are non-oauth kind (and therefore would not be refreshed by the ADK framework)
import google.oauth2.credentials

isinstance(application_default_credentials, google.oauth2.credentials.Credentials)

> False

## Pass these credentials to BigQuery client and it works
from google.cloud import bigquery

client = bigquery.Client(project='...', credentials=application_default_credentials)
for row in client.query_and_wait("SELECT 123"): print(row)

> Row((123,), {'f0_': 0})

I am not sure what's going on in the Agent engine, would need to dig deeper.

[adk-bot]

This issue has been automatically marked as stale because it has not had recent activity for 7 days after a maintainer requested clarification. It will be closed if no further activity occurs within 7 days.

[shobsi]

Commenting to remove the stale tag, it is in my backlog.