Hello everyone,

I have built an ADK-based agent that connects to Databricks and can retrieve various information. However, I’m trying to design a secure way to authenticate each user individually when they interact with the agent.

So far, I see two possible approaches:

1. Using Personal Access Tokens (PATs)

   • I would prefer to avoid this approach because it requires passing PAT tokens, and I don’t want to expose or manage user tokens within the agent.

2. Using OAuth with a Service Principal

   • In this case, we need to use a client_id and client_secret.
   • However, this also involves passing sensitive credentials to the agent, which I would like to avoid for security reasons.

Given these constraints, I’m looking for guidance on:

Is there a recommended approach to securely authenticate each user individually in an agent-based architecture without exposing PATs or client secrets?

For example:

• Are there patterns involving SSO, external identity providers, or backend-mediated authentication?
• Has anyone implemented a per-user authentication model in a similar setup?

I’d really appreciate any suggestions or best practices from the community.

Thanks in advance!