Here is a Drupal 8 Android app code that uses Android accountManager to send user credentials and get the access token. https://github.com/onedrupal/One-Drupal-Android
Whan a token is expired, AccountManager can be used to get a fresh token.
https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/activities/ActivityAuthentication.java At the launch of the activity AccountManager.getAuthTokenByFeatures is called
mAccountManager.getAuthTokenByFeatures(AccountUtils.ACCOUNT_TYPE, AccountUtils.AUTH_TOKEN_TYPE, null, this, null, null, new ActivityAuthentication.GetAuthTokenCallback(), null);
Here is the AccountAuthenticator https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/authenticator/AccountAuthenticator.java
authToken = AccountUtils.mServerAuthenticator.signIn(site_protocol+site_domain, account.name, password);
It uses cookie auth by using endpoint /user/login?_format=json at https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/provider/MyServerAuthenticator.java
But Android AccountManager also works with OAuth.
The only way to discover whether a token is expired or not is to
contact the server, and it would be wasteful and expensive for
AccountManager to continually go online to check the state of all of
Because expired tokens are such a common occurrence, and fixing them
is so easy, many applications just assume the token has expired before
even asking for it. If renewing a token is a cheap operation for your
server, you might prefer to call AccountManager.invalidateAuthToken()
before the first call to AccountManager.getAuthToken(), and spare
yourself the need to request an auth token twice.