Authentication of Agent Custom Tool does not «bubble up» when agent is invoked from Agent Chat Component in a Retool App

Setup

  • configure an agent with a Custom Tool which uses an OpenAPI defined resource query with OAuth authentication configured
  • create a Retool App and add the Agent Chat component to trigger the agent

Expected behavior

  • the user triggers the agent via the Agent Chat Component in the Retool App
  • if the agent decides to use the custom tool where the resource query is used, and the user needs to re-authenticate this «bubbles up» into the conversation and the user can re-authenticate and gets redirected back to the app to continue his conversation

-> this seems to be a supported flow and is described here: Agent access to API with custom authentication - #2 by kent by @kent

Actual behavior

  • the agent returns a log message indicating the need for re-authentication
  • the button to trigger the re-authentication is never visible in the Chat Interface and there is no way to proceed
  • the agent chat component is stuck in a «in progress state»

Last Agent Log Entry:

{
            "agentRunId": "0197bf40-c02b-707f-a683-af86be7fae48",
            "parentRunId": "0197bf40-c02b-707f-a683-af86be7fae48",
            "rootRunId": "0197bf40-c02b-707f-a683-af86be7fae48",
            "spanType": "TOOL_WAITING_FOR_AUTH",
            "timestamp": 1751260392763,
            "iteration": 0,
            "id": "0197bf40-edaa-77ff-b2ee-585da8d7e265",
            "toolData": {
                "toolId": "a73609ca-4f37-4906-9f8c-30b83dc25480",
                "toolName": "findAsset********",
                "toolExecutionId": "747b8743-14f4-4435-bc4c-507516b3d684",
                "toolDescription": "Search for an asset **********",
                "toolType": "function",
                "toolHandlerId": "c51202d3-3068-497a-a79d-1ce8fd6ab13d",
                "toolSnapshot": {
                    "type": "function",
                    "snapshot": [
                        {
                            "uuid": "3916b0c0-d458-4833-8876-7c7f1e671483",
                            "pluginId": "params",
                            "blockType": "webhook",
                            "resourceName": "webhook",
                            "incomingOnSuccessEdges": []
                        },
                        {
                            "uuid": "ec66ff88-4be1-4f8c-82a9-258a1a6cb232",
                            "pluginId": "query1",
                            "blockType": "default",
                            "resourceName": "e74c6339-ba74-49d2-b649-0abd3a8cdf36",
                            "incomingOnSuccessEdges": [
                                "3916b0c0-d458-4833-8876-7c7f1e671483"
                            ]
                        },
                        {
                            "uuid": "60d6485b-a371-4543-ae00-653b38390e1a",
                            "pluginId": "response1",
                            "blockType": "webhookReturn",
                            "resourceName": "JavascriptQuery",
                            "incomingOnSuccessEdges": [
                                "ec66ff88-4be1-4f8c-82a9-258a1a6cb232"
                            ]
                        }
                    ]
                },
                "isPredefinedTool": false,
                "toolUseReasoning": "The user wants to *********",
                "toolUseReasoningSummary": "Searched **********"
            }
        }

For comparison

  • the same described flow works when triggering the agent from the Agents Section of Retool

Environment

  • Retool Cloud

Extra Info

  • the resource is an OpenAPI resource, has 4 different environments and an auth verification endpoint enabled (I use the default environment in the app, the same which is used by the Agent Section, i'll post a separate thread about support to switch environments for agents)
  • the app used is a multipage app
  • the Retool App was initially in draft mode, but also publishing didn't change the behavior