title: Best way to use Google APIs using OAuth 2.0 on Android
body: <p>I'm trying to migrate an Android application using OAuth 1.0a to OAuth 2.0. (using the Google API Client Library for Java/Android for my OAuth 2.0 needs). </p>
  
  <p>What is the best/preferred solution for accessing Google APIs using OAuth 2.0 on an Android platform that takes into account the usability aspect as well. The user should be able to autorize access in an easy way, seamlessly integrating with my Android app. </p>
  
  <p>The application is currently using the OAuth 1.0 web based flow, where my application pops a browser to let the user authorize access, and using a custom redirect URI, my application is capable of retrieving an access token. It works pretty well, but I didn't like the fact that I need to leave my app in order to pop a brower to display a webpage. I was thinking that OAuth 2.0 might work around this, and allow for a better user experience.</p>
  
  <p>I started looking at the <a href="http://www.google.com/events/io/2011/sessions/best-practices-for-accessing-google-apis-on-android.html" rel="noreferrer">Adroid AccountManager-OAuth2 integration as outlined at Google IO</a>, as it doesn't involve a webbrowser, and is more tightly coupled with Android, but it is simply not working the way it should. It's not documented, and unclear if it will remain a viable option for the future.</p>
  
  <p>I've now started investigating the standard OAuth 2.0 web flow.</p>
  
  <p>Here I seem to be having 2 options :</p>
  
  <p><strong>Configure the OAuth 2.0 client as an installed app, and use the urn:ietf:wg:oauth:2.0:oob redirect URI.</strong></p>
  
  <p>Not very clean solution, as I'm not going to have my users copy-paste some code into my app. This is not user-friendly at all.</p>
  
  <p>The <a href="http://code.google.com/apis/accounts/docs/OAuth2.html" rel="noreferrer">Using OAuth 2.0 to Access Google APIs docs</a> mention that there is some way of polling the title of the page to parse out the URL, but I also see a lot of usability issues with that, and don't really feel like writing this kind of plumbing code. If a client library exists that would do that for me, I'd be happy to investigate this further, but for now, I've dropped this option.</p>
  
  <p><strong>Configure the OAuth 2.0 client as a webapp, and use a redirect URI.</strong></p>
  
  <p>Here I noticed non-standard schemes are prohibited in OAuth 2.0. Before, it was possible to use something like xoauth://callback, but that's not allowed anymore. 
  When configuring a redirect URI like <a href="http://mysite.com/oauth2/callback" rel="noreferrer">http://mysite.com/oauth2/callback</a>, I'm unable to have Android open up my activity when the Google OAuth 2.0 page redirects, despite having setup a proper intent filter for it. The <a href="http://mysite.com/oauth2/callback" rel="noreferrer">http://mysite.com/oauth2/callback</a> is simply displayed in my browser. </p>
  
  <p>The following does work</p>
  
  <pre><code>Intent i = new Intent(Intent.ACTION_VIEW,Uri.parse("http://mysite.com/oauth2/callback"));
  startActivity(i);
  </code></pre>
  
  <p>But when the Google OAuth 2 page redirects to that same URL, it is simply displayed in the browser.</p>
  
  <p>Even if this would work, the user would still be presented with a chooser popup (open in browser or open using my Android Activity). From a usability perspective, this is also not acceptable.</p>
  
  <p>I'm looking for a better solution than the ones outlined here. </p>
  
  <p>Regards,
  Davy</p>