title: How can I use Google's OpenID and/or OAuth services to login and allow access to APIs with only ever one prompt to the user?
body: <p>I am attempting to create a login system for my website that permits both authentication via Google's API and access to any of the OAuth-supported Google Data APIs while ideally only showing the user one prompt ever, no matter if he's creating an account or logging into his existing one. I want to minimize the number of times he's asked for approval.</p>
  
  <p>I am aware that Google provides Hybrid OpenID/OAuth for this purpose, but the issue is that <em>every time I add OAuth extensions to my OpenID request, it never remembers the user's approval for that request</em>. Is there <em>any</em> way for the approval to be remembered when I am doing Hybrid OpenID/OAuth? If I just do OpenID without OAuth extensions, everything is remembered just fine and it doesn't keep bugging the user with the prompt.</p>
  
  <p>Here are the pertinent extensions I'm sending in addition to my OpenID request, which result in me getting an OAuth request token (good) but cause the approval to never get remembered (bad).</p>
  
  <p>PHP syntax:</p>
  
  <pre><code>$args["openid.ns.ext2"] = 'http://specs.openid.net/extensions/oauth/1.0';
  $args["openid.ext2.consumer"] = 'www.MYSITE.com';
  $args["openid.ext2.scope"] = 'http://www-opensocial.googleusercontent.com/api/people/';
  $args["openid.mode"] = 'checkid_setup';
  $args["openid.realm"] = 'http://www.MYSITE.com/';
  </code></pre>
  
  <p>Is it normal for Hybrid OpenID/OAuth to act this way (not remembering the last OAuth authorization)? What is the best way to get around this? I have thought of storing cookies on the user's computer to link to somewhere in my database so I could use the last access token again, etc... (the issue here being I don't know whose token to look up unless I know who the user is...a circular problem). And doing an OpenID-only request to get his user ID to see if he has an account in order to look up his access token, followed by an OpenID+OAuth request (if an access token for him isn't stored) would result in two prompts, which really wouldn't help.</p>
  
  <p>It also seems like Hybrid only supports OAuth 1.0, which I think is fine until 2015, so it's not an issue right now for me. I am assuming they will support OAuth 2.0 in the future.</p>
  
  <p>Is <strong>checkid_immediate</strong> relevant to this in any way? I'm just not sure how to use this to accomplish what I want.</p>