DEV Community: sabbir alam

Agentic Ai - Multi Agent development using Google ADK

sabbir alam — Tue, 04 Nov 2025 07:30:38 +0000

Building a Multi-Agent System Using Google’s Agent Development Kit

In modern AI system design, we’re moving away from monolithic, single-purpose models and toward modular, multi-agent architectures — systems composed of specialized components that can reason, collaborate, and delegate.

Recently, I explored this concept hands-on using Google’s latest Agent Development Kit, and built a multi-agent architecture consisting of four agents — one Parent Agent and three specialized sub-agents:

Recommendation Agent
Search Agent
Completion Agent

Each agent is equipped with its own tools for retrieving and updating data in a connected database.

In this post, I’ll walk through the concept, architecture, and data flow — using the analogy of an intelligent control tower system to explain how this architecture functions in real-world scenarios.

The Analogy: An Intelligent Control Tower

Think of the Parent Agent as the control tower of an airport.

Every incoming request is like an aircraft asking for landing instructions.

The tower (Parent Agent) doesn’t fly the planes itself — it analyzes the situation, determines the type of aircraft, and assigns it to the appropriate runway or terminal (sub-agent).

If an unexpected event occurs — say, the assigned runway can’t handle that aircraft — the control tower steps back in, reassesses, and redirects it appropriately.

This analogy reflects how modular agent orchestration enables adaptive and context-aware decision-making.

Architecture Overview

The system is composed of four main agents:

Parent Agent — The Orchestrator

Acts as the entry point for all incoming user requests.
Performs intent classification and task routing.
Delegates work to specialized sub-agents.
Handles re-delegation or fallback responses when needed.

The Parent Agent’s logic acts like a router combined with a context analyzer, determining which sub-agent should take ownership of the request.

Recommendation Agent — Contextual Insights

This agent specializes in generating context-based recommendations — such as suggesting items, actions, or next steps.

It uses internal reasoning plus a custom-built tool that retrieves relevant data from the database to make informed suggestions.

Example use cases:

“Show me trending items.”
“What are the top-rated restaurants nearby?”

Search Agent — Information Retrieval

This agent functions as a retrieval pipeline, focusing purely on fetching structured data with high precision, using database-integrated search tools.

Example queries:

“Find restaurant details by city.”
“Get all entries with a 5-star rating.”

Completion Agent — Task Executor

The Completion Agent is responsible for executing create, update, and completion-based tasks.

Whenever a query involves action rather than retrieval (like inserting or updating data), the Parent Agent delegates it here.

Example tasks:

“Add this restaurant to the database.”
“Update the dish price.”

Workflow: Intelligent Delegation

Here’s how a request moves through the system:

Request Entry:

Every request enters via the Parent Agent.
Intent Classification:

The Parent Agent analyzes the intent using reasoning or classification logic.
Delegation:

It assigns the task to the appropriate sub-agent — Recommendation, Search, or Completion.
Execution:

The selected sub-agent performs the task using its specific toolset.
Re-routing:

If a sub-agent encounters a query outside its scope, it escalates the request back to the Parent Agent.
Fallback:

If no suitable agent exists, the Parent Agent provides a default response.

This process ensures autonomy, modularity, and fault tolerance, enabling the system to adapt dynamically based on the context of the request.

Tooling Layer: Data Access and Actions

Each sub-agent has access to custom tools that interact with the backend database.

Common operations include:

Data retrieval (get, findByField, etc.)
Data modification (insert, update, delete)
Validation and error handling

These tools enable agents to perform real operations, not just generate text.

For example:

“Add a new restaurant to the list.”

The Parent Agent identifies it as a task completion request → delegates to the Completion Agent → which triggers the database insertion tool → and returns a confirmation message.

Why Multi-Agent Design?

The multi-agent approach offers several engineering benefits:

✅ Modularity — Each agent focuses on a specific domain, simplifying debugging and scaling.

✅ Reusability — Agents can be reused or extended for different applications.

✅ Scalability — New agents can be integrated without disturbing existing logic.

✅ Context Isolation — Each agent handles its domain-specific tasks, improving accuracy and reducing confusion.

Compared to a single monolithic agent, this design allows for better adaptability, maintainability, and distributed reasoning.

Takeaways

Implementing this architecture with Google’s Agent Development Kit highlighted how structured delegation transforms conversational AI into a cooperative, context-aware framework.

Instead of one model doing everything, we now design ecosystems of intelligent agents that collaborate effectively — much like distributed microservices in a backend architecture.

The result is a system that’s:

Autonomous
Modular
Scalable
Context-aware

Final Thoughts

As AI continues to evolve, the distinction between “chatbots” and “autonomous systems” is fading.

The true challenge now lies in orchestrating intelligence — designing agents that can reason, delegate, and cooperate efficiently.

By combining modular architectures with tools like Google’s Agent Development Kit, we’re moving toward the era of composable AI systems — where intelligence is not centralized but distributed, dynamic, and domain-aware.

#AI #MultiAgentSystems #AgentDevelopmentKit #GoogleDevelopers #LLMs #SoftwareArchitecture #AIEngineering #Automation #IntelligentSystems

How I Integrated Google Sign-In with Keycloak Token Exchange in Flutter — Step-by-Step 🚀

sabbir alam — Sat, 09 Aug 2025 23:24:11 +0000

Hey Dev Community! 👋

I recently built a Flutter app that uses Google Sign-In for authentication and then exchanges the Google access token for a Keycloak token to secure backend APIs.

I ran into some challenges during the token exchange process, so here’s a walkthrough of how I solved it — plus a snippet of my Flutter Google Sign-In code!

The Challenge 🐞
When I first tried exchanging the Google access token for a Keycloak token, Keycloak kept rejecting the token with errors like:
TOKEN_EXCHANGE_ERROR: subject_token validation failure
and
invalid_request: Parameter 'subject_issuer' is not supported for standard token exchange

before any configuration a very important step is to start the keyclock server correctly
kc.bat start-dev --hostname=<your-host-name> --features="preview,token-exchange,admin-fine-grained-authz:v1"

rest all the configuration remains the same
First you need to create google OAuth Credentials

How to Create Google OAuth Credentials (Client ID & Secret)

Step 1: Go to Google Cloud Console

Open your browser and visit: https://console.cloud.google.com/apis/credentials
Sign in with your Google account.

Step 2: Create or Select a Project

Select an existing project from the top dropdown, or
Click New Project, enter a project name, and create it.

Step 3: Enable the OAuth Consent Screen

In the left sidebar, click OAuth consent screen.
Choose External (for apps used by any Google user) or Internal (for G Suite users only).
Click Create.
Fill out the required fields:
- App name
- User support email
- Developer contact email
Save and continue through scopes and test users (default settings usually work).
Click Save and Continue until done.

Step 4: Create OAuth 2.0 Credentials

Go to Credentials on the left menu.
Click Create Credentials > OAuth client ID.
Select Application type:
- Web application (if your app uses redirects or backend)
- Other (for standalone apps like Flutter)
Enter a name for the client (e.g., "Flutter App Client").

Step 5: Configure Authorized Redirect URIs (for Web Application)

If you chose Web application, add the redirect URI where Google will send users after authentication.

- For Keycloak, this is usually: `https://<your-keycloak-domain>/realms/<realm-name>/broker/google/endpoint`

Step 6: Save and Get Your Client ID and Secret

Click Create.
Copy the Client ID and Client Secret displayed.
Keep them safe to configure in Keycloak.

Summary

Step	Action
1	Go to Google Cloud Console
2	Create/select a project
3	Configure OAuth consent screen
4	Create OAuth client credentials
5	Set redirect URIs if needed
6	Save and copy Client ID & Secret

Part 2: Configure Google as Identity Provider in Keycloak

Step 1: Login to Keycloak Admin Console

Open Keycloak Admin UI and select your realm.

Part 2: Configure Google Identity Provider in Keycloak

Login to Keycloak Admin Console and Open Your Realm

Open the Keycloak Admin UI.
Select your realm.

Add Google as an Identity Provider

Go to Identity Providers in the sidebar.
Click Add provider and select Google.
Enter your Client ID and Client Secret from Google.
Under Advanced Settings, enable Store Tokens.
Click Save.

Configure Your Client (`flutter-app`) for Token Exchange

Go to Clients and select your client (flutter-app).
Enable the following settings:
- Standard Flow
- Direct Access Grants
- Client Authentication
- Authorization
Check Service Account Roles.
Click Save.

Enable and Configure Permissions (Crucial Step!)

⚠️ This is the crucial part of the whole process!

Under Permissions

If Permissions tab is not visible, start Keycloak with the command:
  kc.bat start-dev --hostname=<your-host-name> --features="preview,token-exchange,admin-fine-grained-authz:v1"

Go to the Permissions tab inside your client settings.
Enable Permissions Enabled.
Click on token-exchange permission.
Click Create Client Policy:
- Name the policy.
- Select the client (flutter-app).
- Set decision to Positive.
- Click Save.
Go back to the token-exchange permission, select the policy you just created, and save.

Configure Permissions for the Google Identity Provider

Go to the Google Identity Provider you added.
Under Permissions, enable Permissions Enabled.
Click token-exchange.
Select the same policy you created for the client.
Click Save.

Part 3: Token Exchange Request

Make this request to exchange a Google access token for a Keycloak token:

POST https://<keycloak-server>/realms/<your-releam>/protocol/openid-connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=urn:ietf:params:oauth:grant-type:token-exchange
&subject_token=<GOOGLE_ACCESS_TOKEN>
&subject_token_type=urn:ietf:params:oauth:token-type:access_token
&client_id=<your-client-id>
&client_secret=<CLIENT_SECRET>
&subject_issuer=google
&scope=openid profile email

Note: subject_issuer is the Identity Provider’s name (usually "google").

Flutter Google Sign-In and Keycloak Token Exchange Code

// auth_service.dart

import 'package:google_sign_in/google_sign_in.dart';
import 'package:dio/dio.dart';
import 'package:flutter_secure_storage/flutter_secure_storage.dart';

class AuthService {
  final List<String> scopes = <String>[
    'email',
    'openid',
    'profile',
    'https://www.googleapis.com/auth/userinfo.email',
    'https://www.googleapis.com/auth/userinfo.profile',
  ];
  final GoogleSignIn _googleSignIn = GoogleSignIn.instance;
  bool _initialized = false;

  // Google SignIn Instance
  // final GoogleSignIn _googleSignIn = GoogleSignIn(
  //   scopes: ['email', 'profile', 'openid'],
  // );

  // Secure Storage
  final FlutterSecureStorage _storage = const FlutterSecureStorage();

  // Keycloak Configuration
  final String keycloakUrl =
      "https://knows-pride-future-bon.trycloudflare.com";
  final String realm = "Medical";
  final String clientId = "flutter-app";

  Future<void> _initializeGoogle() async {
    if (_initialized) return;
    try {
      await _googleSignIn.initialize(
        clientId:
            "<your-android-client-id>",
        serverClientId:
            "<your-web-client-id>",
      );
      _initialized = true;
    } catch (e) {
      print("GoogleSign-In initialization failed: $e");
    }
    _initialized = true;
  }

  /// Step 1: Google Sign-In to get ID Token
  Future<String?> signInWithGoogle() async {
    try {
      await _initializeGoogle();
      final GoogleSignInAccount? account = await _googleSignIn.authenticate();
      if (account == null) return null;
      // print(account);

      final GoogleSignInClientAuthorization authorization = await account
          .authorizationClient
          .authorizeScopes(scopes);

      print("access token ${authorization.accessToken}");
      return authorization.accessToken; // <-- Return access token here
    } catch (e) {
      print("Google Sign-In Error: $e");
      return null;
    }
  }

  /// Step 2: Exchange Google ID Token with Keycloak for Access & Refresh Tokens
  Future<Map<String, dynamic>?> exchangeTokenWithKeycloak(
    String googleIdToken,
  ) async {
    final dio = Dio();

    try {
      print("Exchanging token with Keycloak... ${keycloakUrl}");
      final response = await dio.post(
        '$keycloakUrl/realms/$realm/protocol/openid-connect/token',
        data: {
          'client_id': clientId,
          'client_secret': '<your-client-secret>',
          'grant_type': 'urn:ietf:params:oauth:grant-type:token-exchange',
          'subject_token': googleIdToken,
          'subject_token_type': 'urn:ietf:params:oauth:token-type:access_token',
          'requested_token_type':
              'urn:ietf:params:oauth:token-type:access_token',
          'subject_issuer': 'google',
        },
        options: Options(contentType: Headers.formUrlEncodedContentType),
      );

      return response.data;
    } catch (e) {
      print("Keycloak Token Exchange Error: $e");
      return null;
    }
  }

  /// Step 3: Store Tokens Securely
  Future<void> storeTokens(Map<String, dynamic> tokens) async {
    await _storage.write(key: 'access_token', value: tokens['access_token']);
    await _storage.write(key: 'refresh_token', value: tokens['refresh_token']);
  }

  /// Step 4: Get Dio Instance with Authorization Header
  Future<Dio> getAuthorizedDio() async {
    final dio = Dio();
    final token = await _storage.read(key: 'access_token');

    dio.options.headers['Authorization'] = 'Bearer $token';
    return dio;
  }

  // Step 5: Complete Login Flow

  Future<String?> login() async {
    try {
      // Step 1: Google Sign-In to get ID Token
      final googleIdToken = await signInWithGoogle();
      if (googleIdToken == null) return null;

      final keycloakTokens = await exchangeTokenWithKeycloak(googleIdToken);
      if (keycloakTokens == null) return null;

      await storeTokens(keycloakTokens);
      return keycloakTokens['access_token'];

      // Return Access Token
      return keycloakTokens['access_token'];
    } catch (e) {
      print("Login Error: $e");
      return null;
    }
  }

  /// Step 6: Logout from Google and Clear Tokens
  Future<void> logout() async {
    await _googleSignIn.signOut();
    await _storage.deleteAll();
    print("Logged out successfully");
  }
}

Happy coding! 🚀