OAUTH2 code auth flow broken due to # being appended to the end of the callback query string.

[babeal]

Describe the bug

When using the ApplicationIntegrationToolset configured for OAuth2 Code Authorization Flow with an external provider (specifically tested with Microsoft Entra ID), the final callback from the authorization server to the ADK web server results in a broken state, preventing successful token exchange.

The issue is that the ADK web server's handling of the callback URI (or the redirect back to the client) incorrectly appends a trailing hash symbol (#) to the URL query string.

This causes the authlib.oauth2.client.OAuth2Client class to short circuit and not fetch the actual authorization token causing authorization to break. You can see in the image where the OAuth2Client code searches for any # symbol, and if there is one it returns, assuming the authorization code exists, but it does not.

To Reproduce

1. Configure an ApplicationIntegrationToolset with an OAuth2Auth credential set to use Authorization Code Flow (e.g., using AuthCredentialTypes.OAUTH2_CODE) for an external IDP (e.g., Microsoft Entra ID).
2. Start the ADK application and initiate a user request that triggers the OAuth flow.
3. The user completes the external authorization and is redirected back to the ADK callback URI.
4. Observe the failure in the console and the application.
   • ERROR - oauth2_credential_exchanger.py:100 - Failed to exchange OAuth2 tokens: missing_token: Missing 'access_token' in response.

Expected behavior

The ADK web server should successfully process the authorization code and exchange it for a token. The callback URI should not contain a trailing hash symbol (#).

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: macOS
• Python version: Python 3.12.9
• ADK version: Version: 1.14.1

Model Information:

• Are you using LiteLLM: No
• Which model is being used: Gemini 2.5 Flash

Additional context
N/A

[VipRaw001]

hi @babeal,
I am also having similar issue when I am testing it locally in addition to that while deploying this functionality to agentspace,I am frequently getting 400 Reasoning Engine resource [REDACTED_INSTANCE_ID] failed to start and cannot serve traffic.Please refer to our documentation (https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/troubleshooting/deploy) for checking logs and other troubleshooting tips.

[kevinkassimo]

@seanzhou1023 I'll take a look at this

[kevinkassimo]

IIUC for auth related uri construction we are always just using authlib for that (with its create_authorization_url etc.). TBH I think it sounds like an issue we should report to upstream (since its simple check of # existence is already super fragile, and I don't think OAuth's spec ever says anything about empty hash).

For the time being, we can normalize and remove the trailing # to unblock this issue immediately