Why is Google Oauth2 rejecting client id when authenticating via mobile app?

Question

we have a multifaceted application encountering some issues with Google OAuth. There is a Java-based API, along with a React front end and React Native mobile app.

For some time now we have been successfully using OAuth2 to allow Google users to sign in via the React app. We're using the offline/code approach so we first request an authorization code, which gets sent to our API and is then exchanged for a token via Googles servers. The API is responsible for additional checks and account setup.

We're hitting problems however in the mobile app (React native). The app 'appears' to be behaving correctly in that it's obtaining an authorization code, however, when we send this to our API and the API attempts to exchange the code for a token, the response we get back is

 {
  "error": "unauthorized_client",
  "error_description": "Unauthorized"
 }

We can see in our logs, the request looks good. If we compare the post body of this failing request, with the body of a working request we can see content is identical except for the authorization code. Which is expected. So the unauthorized_client error is somewhat misleading.

On the Google Oauth side, both the Android credentials and the Web credentials(used by API) are under the same project, so my understanding is, although they have different client ids, there should not be a problem as Google OAuth supports Cross Client Identity .

Has anyone encountered a similar situation and understands what our problem really is?

Answer 1

The issue can happen if you take a refresh token that was created on a web application and then try to use it on an installed application it wont work as that client id was not the one that was used to create the refresh token.

There is however a single exception that i am aware of. A mobile app client can use the tokens created by other client types with in the same project, this does not work the other way though. Web and installed clients can not use tokens created by mobile app clients. There is something inside mobile clients that is not in the web and installed clients.

hence unauthorized_client meaning that this client id was not authorized by the user.