I am looking at implementing an Authorization Code with PKCE grant on a mobile app to communicate to an API. What I am curious about is what applications currently do with the OpenID token that is granted to the user via Google. Do servers typically use the token granted by Google to handle which user is interacting with the API or do servers take the information from the user info endpoint and grant their own token with claims that they control?


Recommendation would be to generate ones own as then you are now in full control of that token, when it expires, etc. that said, I'm sure there is a site somewhere that doesn't follow this practice.

That said, you may keep a record of the original token as well for audit trail purposes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.