Using Google Sign-In with your server

Posted by Laurence Moroney, Developer Advocate

This is the third part in a blog series on using Google Sign-In on Android, and how you can take advantage of world-class security in your Android apps. In , we then took a deeper dive into the client-side changes to the Google Sign-In APIs that make coding a lot simpler.

In this post, we will demonstrate how you can use Google Sign-In with your backend. By doing so, users signing in on their device can be securely authenticated to access their data on your backend servers.

Using Credentials on your server

First, let’s take a look at what happens if a user signs in on your app, but they also need to authenticate for access to your back-end server. Consider this scenario: You’ve built an app that delivers food to users at their location. They sign into your app, and your app gets their identity. You store their address and order preferences in a database on your server.

Unless your server endpoints are protected with some authentication mechanism, attackers could read and write to your user database by simply guessing the email addresses of your users.

Let’s take a look at the steps for doing this:

Step 1: Your Android app gets an ID token (*) after signing in with Google. There’s a great sample that demonstrates this (see Step 4).

Once your Android app has the token, it can POST it over HTTPS to your server, which will then try to validate it.

(*) An ID token is JSON Web Token, as defined by libraries, in particular, verifying that it was issued by Google and that the intended audience is your server.

Your server can use the of a servlet that was tested on Google App Engine that can verify tokens using a provided library. These libraries allow you to verify the token locally without a network call.

 GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(transport, jsonFactory)  

      // Here is where the audience is set -- checking that it really is your server  

      // based on your Server’s Client ID  

      .setAudience(Arrays.asList(ENTER_YOUR_SERVER_CLIENT_ID_HERE))  

      // Here is where we verify that Google issued the token  

      .setIssuer("https://accounts.google.com").build();  

 GoogleIdToken idToken = verifier.verify(idTokenString);  

 if (idToken != null) {  

      Payload payload = idToken.getPayload();  

      String userId = payload.getSubject();   

      // You can also access the following properties of the payload in order  

      // for other attributes of the user. Note that these fields are only  

      // available if the user has granted the 'profile' and 'email' OAuth  

      // scopes when requested. Even when requested, some fields may be null.  

      // String email = payload.getEmail();  

      // boolean emailVerified = Boolean.valueOf(payload.getEmailVerified());  

      // String name = (String) payload.get("name");  

      // String pictureUrl = (String) payload.get("picture");  

      // String locale = (String) payload.get("locale");  

      // String familyName = (String) payload.get("family_name");  

      // String givenName = (String) payload.get("given_name");  

Note that if you have an existing app using GoogleAuthUtil to get a token to pass to your backend, you should switch to the latest ID token validation libraries and mechanisms described above. We’ll describe recommendations for server-side best practices in a future post.

This post demonstrates how to use authentication technologies to ensure your user is who they claim they are. In the next post, we’ll cover using the Google Sign-In API for authorization, so that users can, for example, access Google services such as Google Drive from within your app and backend service.

You can learn more about authentication technologies from Google at the