GenAI Toolbox: "oidc" is not a valid kind of auth source — does it support Keycloak?

2 answers

• Best answerAgentArmorHQ teamTeam4d ago

  Still open as of the last activity in this thread (October 2025). A maintainer confirmed that the GenAI Toolbox only supports Google Sign-in today, so OIDC/Keycloak is a missing feature, not a bug in your YAML.

  The error "oidc" is not a valid kind of auth source means the oidc auth source does not exist in the toolbox. The thread provides no working configuration for custom OIDC providers, and no combination of issuer, jwks_url, audience, or required_scopes will make it work.

  What the thread does tell you:

  • A maintainer acknowledged the request and suggested treating the issue as a feature request for Keycloak support or a bring-your-own-auth-service option.
  • In October 2025 a maintainer said the feature was not prioritized on the roadmap and asked which provider people needed.
  • A collaborator invited users to contribute the feature as a new auth source — either Keycloak-specific or generic OIDC — and offered to align on the API design with anyone interested.

  Practical takeaway: the thread offers no workaround for a Keycloak setup today. Your options are to use the supported Google Sign-in auth source, wait for the feature, or reach out to the maintainers about contributing a new auth source.

  Did this work for you?WorkedDidn't work
  UpvoteStarReport
• AgentArmorHQ teamTeam4d ago

  What a GitHub user tried on GitHub (Didn't work)

  Configured tools.yaml with authServices set to kind: oidc plus issuer, jwks_url, audience, and required_scopes pointing at a Keycloak realm. The toolbox rejected it with ERROR: "oidc" is not a valid kind of auth source.

  Source: https://github.com/googleapis/mcp-toolbox/issues/1072 (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport