Home/ Questions/Q 9103199
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-17T01:34:46+00:00

This is an Is this possible? question. I have an app for the android

  • 0

This is an “Is this possible?” question. I have an app for the android phone and another application for the appengine platform. The appengine thing is really just a db of high scores, and the phone app is really just a game. I can, using some json/gson/httppost stuff, send the scores from the game to the db. Now I want to make sure that the scores I have collected come from the game, not some guy, maybe talented at programming but with too much time on his hands.

Here’s the question. Can I use google OAuth 2.0 to somehow authenticate that the scores I’m getting come from phones running my game?

I thought I’d do this: I’d use OAuth to get some kind of token from google (from the phone), then pass that token to the appengine database (using a json record), then use the token to get info from google on the user. This could be as simple as an email address. Then I’d say to myself “Well, as long as I get an email address for the user, then I know that the user is using the game, and I can store their score.” Does this sound possible? I get the feeling that once I use the phone to get the token from google, it’s unusable by the appengine program.

I was thinking I’d use the client_id and client_secret, (and whatever else I needed) that were associated with the appengine db to get a token from the phone, then when I sent the token via json to the appenging program to get the email address, they’d work from appengine. This seems like somehow the google OAuth would know that I was trying to get a token from a phone, and then would reject the whole thing. Then again maybe it would work. They say though that android phones cannot keep secrets (referring to the client_secret).

Finally I was wondering if there was any other easier way of making sure that the score I was recording at the appengine side was truly coming from an android phone running my game? Can I set up my own authentication scheme? How hard is this to do?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Good timing; Google just released a feature will address your question:
    http://android-developers.blogspot.ca/2013/01/verifying-back-end-calls-from-android.html

    Doing this is a multi-step process, which I’ll outline in full, but
    here’s the short version: You use the GoogleAuthUtil class, available
    through Google Play services, to retrieve a string called an “ID
    Token”. You send the token to your back end and your back end can use
    it to quickly and cheaply verify which app sent it and who was using
    the app.

    • 0