So this might gonna be a newbe question.
I'm developing an REST(ful) JSON application programming interface with PHP. This API will be primarily accessed by Android-devices via an App. Due to the fact only people with G+ Accounts will use this app I want to use Google API for user-authentication. So far, so simple.
But I'm using GoogleAPI for the first time and I read interesting and needed parts of the Google API DevDocs. So I found the google-api-php-client that I'm using for now.
Here is how I thought this auth-process works:
- User logs into G+Account on mobile device (or similar; I read something about an PlayStore ID Token or something here)
- The app does have a token now (like stated here (response))
"access_token":"1/fFAGRNJru1FTz70BzhT3Zg", "expires_in":3920, "token_type":"Bearer"
- Android-App sends Request to my PHP API like
GET /meeting/:id
and sends the access_token (1/fFAGRNJru1FTz70BzhT3Zg
only), too. - My app can take the access_token and can ask
googleAPI/people/me
for the ID of the user. - User is identified in request on my API and the magic can go on
But there is a problem with the mentioned Google-lib for PHP:
the function setAccessToken($accessToken)
requires the whole JSON-response as the docs says:
{"access_token":"TOKEN",
"refresh_token":"TOKEN",
"token_type":"Bearer",
"expires_in":3600,
"id_token":"TOKEN",
"created":1320790426}
(see here) of a auth-request to GoogleAPI.
It can't be the solution to send the whole JSON-response with id_token, refresh_token and access_token to my API on every request as this will cause huge load of traffic and I'm sure that there is a simple solution, but I don't see it.
I hope I could explain my thoughts and problems properly and I hope that my english is not that bad.