I am linking a Drupal site to an Android application. With the help of the Simple OAuth module, users will log in to my android app using their Drupal site credentials.

I understand that once the client application has the access token, it can be included in the headers of any GET request to fetch JSON content from Drupal. I also know that https://example.com//simple-oauth/refresh will give a new access token, having the refresh token.

What should I do if both access and the refresh tokens are already expired? How do I get them from scratch? What is the URL to ask for the token, and how do I include the credentials with that via HTTP headers or in the URL?

Is there something I'm not aware of about this way of authenticating?

  • From what I understand, what you are describing isn't possible with the simple_oauth module. – lukedekker Jan 16 '17 at 22:00
  • Ya, it seems like it. I guess simple_oauth module is not sophisticated enough, yet!! If I'm not mistaken, you have to get the refresh token manually and then client has to keep sending it every time just before it expires to get the new one. I'm not an expert on the topic but I think this is useless if you want to build an industry standard app. – Moqbel Jan 17 '17 at 8:28
  • I developed some Android application for Drupal 7 in the past. What I had done is to authenticate with username and password (using RESTful endpoint - services), stored the cookie and re-used it in all subsequent requests. So that is one way to do it. – W.M. Nov 30 '17 at 21:32

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.