Q:

How to make a Google App Engine authentiated request from an Android app?

I'm trying to make an authenticated request from an Android app on my backend deployed on Google App Engine.
I tried to follow this guide but apparently I'm missing something...
Here is what I've already done:
In Google Cloud Console, I added an Android app giving the app package name (defined in the manifest.package attribute of AndroidManifest.xml) and the app's certificate SHA1 hash retrieved with this command (I'm in debug mode, using the debug keystore):
keytool -exportcert -alias androiddebugkey -keystore ~/.android/debug.keystore -v -list

Now in the android app I try to get a token
Account account = mAccountManager.getAccountsByType("com.google")[0]
String scope = "audience:server:client_id:THE_CLIENT_ID_FROM_GOOGLE_CLOUD_CONSOLE_GAVE_ME";
String token = GoogleAuthUtil.getToken(myActivity, account.name, scope);

Unfortunately this code systematically raises a GoogleAuthException("Unknown")
Does anyone have any clue on what I'm doing wrong ?

A:

I think you are using the client id of your Android application in the scope.
It doesn't work this way: you have to create a web application client ID in the same project where the Android client id is, and use the web project's client id in your scope.
Then in your GAE application you can check the validity of the token by setting the web application client ID as your audience, and using your Android client id for checking the authorized party.

