Take the 2-minute tour ×

This is an "Is this possible?" question. I have an app for the android phone and another application for the appengine platform. The appengine thing is really just a db of high scores, and the phone app is really just a game. I can, using some json/gson/httppost stuff, send the scores from the game to the db. Now I want to make sure that the scores I have collected come from the game, not some guy, maybe talented at programming but with too much time on his hands.

Here's the question. Can I use google OAuth 2.0 to somehow authenticate that the scores I'm getting come from phones running my game?

I thought I'd do this: I'd use OAuth to get some kind of token from google (from the phone), then pass that token to the appengine database (using a json record), then use the token to get info from google on the user. This could be as simple as an email address. Then I'd say to myself "Well, as long as I get an email address for the user, then I know that the user is using the game, and I can store their score." Does this sound possible? I get the feeling that once I use the phone to get the token from google, it's unusable by the appengine program.

I was thinking I'd use the client_id and client_secret, (and whatever else I needed) that were associated with the appengine db to get a token from the phone, then when I sent the token via json to the appenging program to get the email address, they'd work from appengine. This seems like somehow the google OAuth would know that I was trying to get a token from a phone, and then would reject the whole thing. Then again maybe it would work. They say though that android phones cannot keep secrets (referring to the client_secret).

Finally I was wondering if there was any other easier way of making sure that the score I was recording at the appengine side was truly coming from an android phone running my game? Can I set up my own authentication scheme? How hard is this to do?

share|improve this question
The phone itself has an id, why not use that to keep track of the player (could get tricky if there was more than one player per phone though) Settings.System.ANDROID_ID –  user784435 Jan 8 '13 at 18:36

2 Answers 2

up vote 2 down vote accepted

Good timing; Google just released a feature will address your question: http://android-developers.blogspot.ca/2013/01/verifying-back-end-calls-from-android.html


share|improve this answer
I have yet to try this out but it looks promising. –  D Liebman Jan 8 '13 at 19:10
This is essentially using (bits of) Open ID connect to achieve the same thing. User authentication is quite reliable, but it is not too hard to spoof the source app. If you are storing scores, etc. per each user it should work for you. –  Nikolay Elenkov Jan 9 '13 at 2:48
@NikolayElenkov, how would you spoof the source app if you use this method? –  Victor Feb 20 '13 at 10:11
Get a valid Google master token from any rooted device, extract the client ID from the app you want to spoof, construct and send an appropriate request. The only things that can be validated are the Google account (which is valid) and the client ID (which matches, because you got it from the app). The package name hash of the signing certificate are public information for any app. –  Nikolay Elenkov Feb 20 '13 at 14:04

With OAuth 2.0 (Open ID connect) you can identify the user that is using your game. It seems that you want to authenticate the app though. There are multiple ways to do this, but you still have to embed the credentials in the app or create some sort of registration mechanism. Generally, as long as your attacker (skillful user) has full access to app code and the device (rooted, etc.), there is not much you can do. The only question is who hard do you want to make it.

Or you can use a third party service such as Parse, and trust that they spend some time perfecting their app authentication mechanism.

share|improve this answer

Your Answer


