title: Google SignIn - "access_token" vs "id_token" vs "code"
body: <p>In our website we used to use access_token when logging people with Google Sign In. First, we redirect the user to google, user brings the access_token to us, and we validate that token to make sure the user is the actual Google user. </p>
  
  <p>Then, we needed a Google sign-in feature for our Android app, so I wanted the Android developer to bring access_token to us. He replied he couldn't. I searched about that finding almost no documentation about access_token. In documentation, Google says me to use the "id_token". </p>
  
  <p>OK, I wanted the developer to bring me the id_token, and I have successfully verified the token's integrity. Then I wanted to implement the same for websites. </p>
  
  <p>My c# code is:</p>
  
  <pre><code>string googleId = GoogleJsonWebSignature.ValidateAsync(idToken).Result.Subject;
  </code></pre>
  
  <p>It worked when I ran it locally, but when I tried in production, it gave an error: <em>JWT is not yet valid</em></p>
  
  <p>Is id_token the correct way to send to the backend and verify? I found another option too: <strong>code</strong>. </p>
  
  <p>Code is something like A/12112312......</p>
  
  <p>Access_token is something like ya29.somemorestring</p>
  
  <p>My question is, Which one is correct to send to the backend? By the way, I think access_token is sort of deprecated or something like that.</p>