Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a question about having users logon to my service using their Google Credentials. I've gone through the Using OAuth 2.0 for Login documentation provided by Google.

The documentation mentions an id_token (JWT token) as the primary authentication token that can be passed around and verified by the application.

On the other hand, together with the id_token, the Google Oauth 2.0 API also returns an access token (that can be long-lived depending on the access_type)

Now, Facebook and Twitter also use OAuth to allow third party webapps with a "login using twitter" or "login using facebook" button. They assume that when an access token is retrieved through their APIs it considers the user authenticated.

Wouldn't the same be possible with Google? If I just use their OAuth 2.0 API to retrieve an access token and verify the access token by retrieving some user info like email, would that be considered a valid authentication flow ? Or am I missing something here ?

share|improve this question

This post may answer your question. The best solution is to use OpenID Connect (id_token) since this will be the standard way to do it (still a draft).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.