Hey everyone, If you’ve tried using the Agent Development Kit (ADK) with custom LLM endpoints (like Ollama or vLLM) hosted behind a secure, IAM-enforced Cloud Run service, you’ve probably hit a wall with token expiration. While ADK handles credential discovery automatically for MCP tools and remote agents, the LiteLLM connector requires you to handle authorization manually. If you just grab an ID token at startup and pass it in the headers, your agent will crash with an HTTP 401 after one hour when the token expires. I put together these three different approaches depending on your architecture: Static token injection (fine for scale-to-zero agents that shut down quickly). Dynamic token injection via subclassing LiteLLMClient to intercept acompletion, handle token retrieval from Application Default Credentials (ADC), and catch 401s to refresh dynamically. A LiteLLM-proxy sidecar configuration on Cloud Run to completely offload auth logic from your agent's primary application code.…