From a6b1baa61b5dbf4168a035609077094307171135 Mon Sep 17 00:00:00 2001
From: "Xiang (Sean) Zhou" <seanzhougoogle@google.com>
Date: Mon, 16 Jun 2025 17:04:27 -0700
Subject: [PATCH] chore: Add base credential exchanger (Experimental)

PiperOrigin-RevId: 772227201
---
 src/google/adk/auth/exchanger/__init__.py     | 25 ++++++++++
 .../exchanger/base_credential_exchanger.py    | 49 +++++++++++++++++++
 2 files changed, 74 insertions(+)
 create mode 100644 src/google/adk/auth/exchanger/__init__.py
 create mode 100644 src/google/adk/auth/exchanger/base_credential_exchanger.py

diff --git a/src/google/adk/auth/exchanger/__init__.py b/src/google/adk/auth/exchanger/__init__.py
new file mode 100644
index 00000000..ce5c464c
--- /dev/null
+++ b/src/google/adk/auth/exchanger/__init__.py
@@ -0,0 +1,25 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Credential exchanger module."""
+
+from .base_credential_exchanger import BaseCredentialExchanger
+from .credential_exchanger_registry import CredentialExchangerRegistry
+from .service_account_credential_exchanger import ServiceAccountCredentialExchanger
+
+__all__ = [
+    "BaseCredentialExchanger",
+    "CredentialExchangerRegistry",
+    "ServiceAccountCredentialExchanger",
+]
diff --git a/src/google/adk/auth/exchanger/base_credential_exchanger.py b/src/google/adk/auth/exchanger/base_credential_exchanger.py
new file mode 100644
index 00000000..1d7417cd
--- /dev/null
+++ b/src/google/adk/auth/exchanger/base_credential_exchanger.py
@@ -0,0 +1,49 @@
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Base credential exchanger interface."""
+
+from __future__ import annotations
+
+import abc
+from typing import Optional
+
+from ...utils.feature_decorator import experimental
+from ..auth_credential import AuthCredential
+from ..auth_schemes import AuthScheme
+
+
+@experimental
+class BaseCredentialExchanger(abc.ABC):
+  """Base interface for credential exchangers."""
+
+  @abc.abstractmethod
+  async def exchange(
+      self,
+      auth_credential: AuthCredential,
+      auth_scheme: Optional[AuthScheme] = None,
+  ) -> AuthCredential:
+    """Exchange credential if needed.
+
+    Args:
+        auth_credential: The credential to exchange.
+        auth_scheme: The authentication scheme (optional, some exchangers don't need it).
+
+    Returns:
+        The exchanged credential.
+
+    Raises:
+        ValueError: If credential exchange fails.
+    """
+    pass