Question

I’m writing an Android application that I want to be able to send requests to a Google App Engine application. In order to do this, the Android app needs to authenticate the user (should be able to just use their Google Account). I’m not sure I’m doing it right, but this is the only way I’ve found so far:

1. Post email, password, etc. to https://www.google.com/accounts/ClientLogin
2. Obtain an authorization token from the aforementioned address
3. Use the authorization token in the header of the requests to the AppEngine application

But this isn’t working (users.get_current_user() still returns None). Is there a right way to do it?

Answer 1

The approach you describe is almost correct. Instead, you need to:

1. Submit the credentials to ClientLogin and get back the authorization token.
2. Submit the authorization token to /_ah/login and get back a cookie (and 302 redirect).
3. Use the returned cookie on all subsequent requests.

This is the process appcfg uses – see appengine_rpc.py for an example of how to use it (and a module you can use, if you’re using Python) – specifically, the _Authorize function.