Take the 2-minute tour ×

New to OAuth2. I am writing an Android app that communicates with an App engine server application.

  1. The app needs to authenticate itself with the server on behalf of the user, using Google account info of the user. The server needs to retrieve the user's basic info and create an account . That's the easy part and I know how to do this.
  2. Furthermore, the Android app will also have the user authenticate himself/herself using Oauth2 and retrieve basic user info using Google account info of the user. I can do this as well.
  3. This is where I need help Assuming the previous steps have been completed successfully, how can I use the Android app (where the user has logged in) to communicate with the server securely using the user's credentials.

Any ideas or am I missing something obvious?

share|improve this question
Have you looked at the "App Engine connected Android App" option in Eclipse? –  Nick Johnson May 21 '12 at 6:41

2 Answers 2

Using OAuth, 1.0 or 2.0, doesn’t matter in this, leads to the app obtaining an access token - then based on the API of your server, you pass this access token with requests instead of login and password. I guess the way to attach the access token string to URL requests may be slightly different between different APIs, see the documentation for yourself. Or if you are making the server app at the same time, then you need to figure out your way to do so (like sending a HTTP header Authorization: OAuth access_token=abcdefgh….

share|improve this answer
Won't this approach be vulnerable to snooping? –  pbhowmick May 21 '12 at 15:42
Well, OAuth 1.0 makes heavier use of cryptography, in a way that would make any snooping useless (private secrets and so on), but you can still force some signatures for requests (but you have to implement that on your own though). Using HTTPS together with OAuth is a good idea, too. Check the OAuth 2 documentation, I think it’s a pretty secure scheme, even though I’ve heard some concerns about security with all the cryptography being gone. –  themarketka May 22 '12 at 21:00

The Android to App Engine OAuth2 communication is documented in this answer: google app engine oauth2 provider

share|improve this answer

Your Answer


