如何在Android设备上使用Google OAauth2.02连接到node.js后端？

Question

I'm building a Android/iOS/Web app which authenticates with a provider to receive an access token and then uses the token in the API calls to the node.js backend. I've already got it working for facebook using Passport and the Facebook-Token strategy ( https://github.com/drudge/passport-facebook-token )

Now I'd like to repeat the process with this library https://www.npmjs.org/package/passport-google-token

Should be easy, right? But google's developer console for android doesn't provide a client secret. Infact there is very little documentation on what to do if you would like to authenticate on the device and use a token to communicate with the server. It was so simple with facebook, is there something I am missing?

Answer 1

FB's (or Google's) access_token is for their API, not yours. Also, most flows with 3rd party providers like FB and Google are intended for web sites (this is the auth code grant ). Devices (and SPA) typically use the implicit flow that doesn't require secrets on the client.

You might want to consider authenticating users with Google or FB (or whatever) in your website (using either strategies which are optimized for web flows), and then issue an API specific token derived from that. I would recommend issuing JWT , which are lightweight and simple to use.

On the API side you could use express-jwt . See here for additional details.