I am linking a Drupal site to an Android application. With the help of the Simple OAuth module, users will log in to my android app using their Drupal site credentials.

I understand that once the client application has the access token, it can be included in the headers of any GET request to fetch JSON content from Drupal. I also know that https://example.com//simple-oauth/refresh will give a new access token, having the refresh token.

What should I do if both access and the refresh tokens are already expired? How do I get them from scratch? What is the URL to ask for the token, and how do I include the credentials with that via HTTP headers or in the URL?

Is there something I'm not aware of about this way of authenticating?

  • From what I understand, what you are describing isn't possible with the simple_oauth module.
    – lukedekker
    Jan 16, 2017 at 22:00
  • Ya, it seems like it. I guess simple_oauth module is not sophisticated enough, yet!! If I'm not mistaken, you have to get the refresh token manually and then client has to keep sending it every time just before it expires to get the new one. I'm not an expert on the topic but I think this is useless if you want to build an industry standard app. Jan 17, 2017 at 8:28
  • I developed some Android application for Drupal 7 in the past. What I had done is to authenticate with username and password (using RESTful endpoint - services), stored the cookie and re-used it in all subsequent requests. So that is one way to do it.
    – W.M.
    Nov 30, 2017 at 21:32

1 Answer 1


Moqbel, Here is a Drupal 8 Android app code that uses Android accountManager to send user credentials and get the access token. https://github.com/onedrupal/One-Drupal-Android

Whan a token is expired, AccountManager can be used to get a fresh token. https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/activities/ActivityAuthentication.java At the launch of the activity AccountManager.getAuthTokenByFeatures is called

mAccountManager.getAuthTokenByFeatures(AccountUtils.ACCOUNT_TYPE, AccountUtils.AUTH_TOKEN_TYPE, null, this, null, null, new ActivityAuthentication.GetAuthTokenCallback(), null);

Here is the AccountAuthenticator https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/authenticator/AccountAuthenticator.java

authToken = AccountUtils.mServerAuthenticator.signIn(site_protocol+site_domain, account.name, password);

It uses cookie auth by using endpoint /user/login?_format=json at https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/provider/MyServerAuthenticator.java

But Android AccountManager also works with OAuth.

from https://developer.android.com/training/id-auth/authenticate

The only way to discover whether a token is expired or not is to contact the server, and it would be wasteful and expensive for AccountManager to continually go online to check the state of all of its tokens.

Because expired tokens are such a common occurrence, and fixing them is so easy, many applications just assume the token has expired before even asking for it. If renewing a token is a cheap operation for your server, you might prefer to call AccountManager.invalidateAuthToken() before the first call to AccountManager.getAuthToken(), and spare yourself the need to request an auth token twice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.