ADK agents to support changing identity tokens

[VeerMuchandi]

** Please make sure you read the contribution guide and file the issues in the right place. **
Contribution guide.

Is your feature request related to a problem? Please describe.
When external tools (APIs, MCP tools) require auth tokens, we need the ability refresh those tokens every once in a while. We need ability for ADK agents to accept refreshed tokens.

Describe the solution you'd like
A clear and concise description of what you want to happen.
See this agent code as an example

from google.adk.tools.mcp_tool.mcp_session_manager import (
    SseConnectionParams,
)
from google.adk.tools.mcp_tool.mcp_toolset import MCPToolset
from google.adk.agents import LlmAgent
from google.auth.transport.requests import Request as AuthRequest
from google.oauth2 import id_token
from urllib.parse import urlparse


def create_agent():
  """Gets tools from MCP Server."""
  url = "https://country-server-121968733869.us-central1.run.app/sse"

  # For invoking a Cloud Run service, we need an ID token.
  # The audience for the ID token is the root URL of the service.
  parsed_url = urlparse(url)
  audience = f"{parsed_url.scheme}://{parsed_url.netloc}"

  identity_token = id_token.fetch_id_token(AuthRequest(), audience)

  auth_header = {"Authorization": f"Bearer {identity_token}"}

  toolset = MCPToolset(
      connection_params=SseConnectionParams(url=url, headers=auth_header)
  )
  agent = LlmAgent(
      model="gemini-2.0-flash",
      name="country_agent",
      instruction=("Help get detailed information about a country"),
      tools=[toolset],
  )
  return agent


root_agent = create_agent()

In this case the tool running on Cloud Run requires identity_token passed as a Authorization param and this token expires every 60m. How do we refresh the agent with the changed identity_token after the agent creation?

If there is way to do it already, happy to use that approach.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

[Satheesh-Balachandran]

+1 - This is mandatory for connecting to an enterprise grade MCP server