How do I call Google Cloud Endpoints on Android without user Google sign-in?

Question

I have an Android app (a game) that's calling a Cloud Endpoints backend service. The app lets you "sign in" using Facebook, Google, Twitter, or a custom game account. This fetches their email, which I use on the backend to look up the characters.

The iOS version of my game calls my Cloud Endpoints service using the generated client library, with some application credentials supplied by the Cloud Endpoints setup process. The user does NOT need to be signed into a Google account in order to make these calls -- they can be signed into Facebook or in some cases (e.g. viewing leaderboards) not signed in at all. Somehow the Cloud Endpoints client stub is using my application's credentials to authorize my app.

For Android, the setup seems to require a GoogleAccountCredential with a non-null account name. Which, as far as I can tell, means the user has to go through a (Google) sign-in flow. This defeats the purpose of letting them sign in with Facebook instead.

My service stub initialization looks something like this:

myAudience = "server:client_id:" + getStringResource(R.string.google_webapp_client_id);
credential = GoogleAccountCredential.usingAudience(myAudience);
if (credential.getSelectedAccountName() == null) {
  chooseAccount();  // Calls startActivityForResult with credential.newChooseAccountIntent().
}
myApiService = new MyApiService.Builder(AndroidHttp.newCompatibleTransport(), new AndroidJsonFactory(), credential);

This works just fine -- but it requires the user to sign in to a Google account in order to make the service call.

Is there a way to make an authorized Cloud Endpoints calls from Android without requiring a Google account sign-in, as is the case on iOS? I just want it to use whatever private application credentials are generated for my app, but I don't know how to build a credential that way.

Limin Limin · Accepted Answer · 2017-05-21T18:44:18

Cloud Endpoints provides authentication for your API backend. Endpoints "validates"/"authenticates" the JWT, but it does not "generate" the JWT. Typically, an iOS or Andriod App that wants to allow sign-in from different identity providers (e.g., Google, Facebook), uses Auth0 or Firebase to generate an end user JWT.

The application credentials provided during Cloud Endpoints setup process are used to authenticate the API producers when deploying the Endpoints service, or representing the Cloud Endpoints API itself. They do NOT represent the end users who are trying to access the Endpoints API.

How do I call Google Cloud Endpoints on Android without user Google sign-in?

1 Answers