def credential_to_param(
    auth_scheme: AuthScheme,
    auth_credential: AuthCredential,
) -> Tuple[Optional[ApiParameter], Optional[Dict[str, Any]]]:
  """Converts AuthCredential and AuthScheme to a Parameter and a dictionary for additional kwargs.

  This function now supports all credential types returned by the exchangers:
  - API Key
  - HTTP Bearer (for Bearer tokens, OAuth2, Service Account, OpenID Connect)
  - OAuth2 and OpenID Connect (returns None, None, as the token is now a Bearer
  token)
  - Service Account (returns None, None, as the token is now a Bearer token)

  Args:
      auth_scheme: The AuthScheme object.
      auth_credential: The AuthCredential object.

  Returns:
      Tuple: (ApiParameter, Dict[str, Any])
  """
  if not auth_credential:
    return None, None

  if (
      auth_scheme.type_ == AuthSchemeType.apiKey
      and auth_credential
      and auth_credential.api_key
  ):
    param_name = auth_scheme.name or ""
    python_name = INTERNAL_AUTH_PREFIX + param_name
    if auth_scheme.in_ == APIKeyIn.header:
      param_location = "header"
    elif auth_scheme.in_ == APIKeyIn.query:
      param_location = "query"
    elif auth_scheme.in_ == APIKeyIn.cookie:
      param_location = "cookie"
    else:
      raise ValueError(f"Invalid API Key location: {auth_scheme.in_}")

    param = ApiParameter(
        original_name=param_name,
        param_location=param_location,
        param_schema=Schema(type="string"),
        description=auth_scheme.description or "",
        py_name=python_name,
    )
    kwargs = {param.py_name: auth_credential.api_key}
    return param, kwargs

  # TODO(cheliu): Split handling for OpenIDConnect scheme and native HTTPBearer
  # Scheme
  elif (
      auth_credential and auth_credential.auth_type == AuthCredentialTypes.HTTP
  ):
    if (
        auth_credential
        and auth_credential.http
        and auth_credential.http.credentials
        and auth_credential.http.credentials.token
    ):
      param = ApiParameter(
          original_name="Authorization",
          param_location="header",
          param_schema=Schema(type="string"),
          description=auth_scheme.description or "Bearer token",
          py_name=INTERNAL_AUTH_PREFIX + "Authorization",
      )
      kwargs = {
          param.py_name: f"Bearer {auth_credential.http.credentials.token}"
      }
      return param, kwargs
    elif (
        auth_credential
        and auth_credential.http
        and auth_credential.http.credentials
        and (
            auth_credential.http.credentials.username
            or auth_credential.http.credentials.password
        )
    ):
      # Basic Auth is explicitly NOT supported
      raise NotImplementedError("Basic Authentication is not supported.")
    else:
      raise ValueError("Invalid HTTP auth credentials")

  # Service Account tokens, OAuth2 Tokens and OpenID Tokens are now handled as
  # Bearer tokens.
  elif (auth_scheme.type_ == AuthSchemeType.oauth2 and auth_credential) or (
      auth_scheme.type_ == AuthSchemeType.openIdConnect and auth_credential
  ):
    if (
        auth_credential.http
        and auth_credential.http.credentials
        and auth_credential.http.credentials.token
    ):
      param = ApiParameter(
          original_name="Authorization",
          param_location="header",
          param_schema=Schema(type="string"),
          description=auth_scheme.description or "Bearer token",
          py_name=INTERNAL_AUTH_PREFIX + "Authorization",
      )
      kwargs = {
          param.py_name: f"Bearer {auth_credential.http.credentials.token}"
      }
      return param, kwargs
    return None, None
  else:
    raise ValueError("Invalid security scheme and credential combination")
Converts AuthCredential and AuthScheme to a Parameter and a dictionary for additional kwargs.

  This function now supports all credential types returned by the exchangers:
  - API Key
  - HTTP Bearer (for Bearer tokens, OAuth2, Service Account, OpenID Connect)
  - OAuth2 and OpenID Connect (returns None, None, as the token is now a Bearer
  token)
  - Service Account (returns None, None, as the token is now a Bearer token)

  Args:
      auth_scheme: The AuthScheme object.
      auth_credential: The AuthCredential object.

  Returns:
      Tuple: (ApiParameter, Dict[str, Any])
  
src/google/adk/tools/openapi_tool/auth/auth_helpers.py