仅限访问我的Android应用程序的端点

Question

I'm new to the Google App Engine, and I'm trying to make my first engine and connect it to my Android app. I have walked through this tutorial in order to learn about it:

https://cloud.google.com/endpoints/docs/frameworks/legacy/v1/java/helloendpoints-android-studio

I got it to work fine. I can access my app engine from my android app, and get the wanted response. The problem is, I want to restrict the endpoints of my API to my app's users only.

This is my API method (from the tutorial), and as for now, everyone can access my api's explorer and execute methods in it, as long as they are logged in to any Google account.

I want the users to be able to execute this method from my app only.

This is my app engine java file:

package com.example.Barda.myapplication.backend;

import com.google.api.server.spi.config.Api;
import com.google.api.server.spi.config.ApiMethod;
import com.google.api.server.spi.config.ApiNamespace;
import com.google.api.server.spi.response.UnauthorizedException;
import com.google.appengine.api.users.User;

import javax.inject.Named;

/**
 * An endpoint class we are exposing
 */
@Api(

        name = "myApi",
        version = "v1",
        clientIds = {Constants.ANDROID_CLIENT_ID},
        audiences="firebase-wiki-race.appspot.com",
        namespace = @ApiNamespace(
                ownerDomain = "backend.myapplication.Barda.example.com",
                ownerName = "backend.myapplication.Barda.example.com",
                packagePath = ""
        )

)
public class MyEndpoint {
    /**
     * A simple endpoint method that takes a name and says Hi back
     */
    @ApiMethod(name = "sayHi")

    public MyBean sayHi(@Named("name") String name) throws UnauthorizedException {

      //  if (user == null) throw new UnauthorizedException("User is Not Valid");

        MyBean response = new MyBean();
        response.setData("Hi, " + name);
        return response;
    }

}

This is constants class:

package com.example.Barda.myapplication.backend;

/**
 * Contains the client IDs and scopes for allowed clients consuming your API.
 */
public class Constants {
    public static final String ANDROID_CLIENT_ID = "*********************.apps.googleusercontent.com";

}

I have generated using my app's SH-1 and package name the ANDROID_CLIENT_ID .

---

I have searched online a lot, and read blogs and threads, but I couldn't make it work. Is this a possible thing to do? What am I doing wrong?

Answer 1

You'll want to follow the documentation's guide on adding authorization to the API backend . In this process you define a list of clients that are authorized to use your Endpoint.

Once that's done you can follow the guide on making authenticated calls from Android.