Question

I need to get an oauth token from within an android app that will allow me to connect to my appengine application as well as be able to send emails from the user’s account. The problem I’ve run into is that for some reason there is not really any good documentation on the auth token scopes that are available.

From what I’ve found you can concat the auth tokens with a space delimeter but I’m having no luck.
accountManager.getAuthToken(account, "oauth2:https://mail.google.com/", null, activity, new AuthTokenCallback(), null);
works just fine to get an email token.

Likewise
accountManager.getAuthToken(account, "ah", null, activity, new AuthTokenCallback(), null);
works great for an app engine token.

However
accountManager.getAuthToken(account, "oauth2:https://mail.google.com/ ah", null, activity, new AuthTokenCallback(), null);
gets me into an error

Couldn't sign in,
There was a problem communicating with Google servers
Try again later

How can I get these two to work together like good little well behaved Google services?

Answer 1

The problem is that you are trying to mix an OAuth 2.0 scope (“https://mail.google.com/“) with a ClientLogin scope (“ah”) and I do not think this is supported.

When you want a token with many permission levels, you concatenate them with a space delimiter as you say. For OAuth 2 scopes it is done like this: oauth2:{space separated list of scopes}.

When you provide the scope oauth2:https://mail.google.com/ ah it is assumed that both scopes are OAuth 2 scopes. But since “ah” isn’t a valid OAuth 2 scope the Google servers won’t accept it and instead gives you the error you see.

I’m not aware of any OAuth 2 scope for the App Engine and two older questions here on Stackoverflow from 2011 and 2012 suggests that it doesn’t support OAuth 2 yet.