4

I'm trying to learn how to implement an OAuth flow in an Android app -- using a simple app with the Stack Exchange API.

Using webView, I'm able to retrieve an access token and store it in my shared preferences. My doubt is how to deal with token expiration.
I don't think I'm supposed to show the webView again am I?

I'm really new in the subject. Thanks.

Improve this question
2
  • I don see why is nuclear. I agree with the API and by this I mean StackEchange API. But besides that what was not clear. I can request an acess token but dont know how to refresh It once is expired. As I stated Im working with Android and web View to fulfill the flow. Let me know what else can I clarify – Marco Pierucci Oct 31 '16 at 3:07
  • While its true, the documentation states that is " the use of which is strongly advised against" beside the idea is to improve my skills and i would like to know how to deal with expiration(If the api allows it ofcourse) – Marco Pierucci Oct 31 '16 at 14:41
2

Dealing with token expiration is pretty simple.
When a token is/goes bad then, when you make an API call that uses the token, you will get a JSON response like this:

{
    "error_id": 403,
    "error_message": "`key` is not valid for passed `access_token`, token not found.",
    "error_name": "access_denied"
}

At that point, just re-authenticate.

You can also pre-check a token using the /access-tokens/{accessTokens} route but that's overkill in must scenarios.

I don't recommend using a no_expiry token, for security reasons, and even such tokens can be invalidated. So, your app needs to know how to handle bad tokens anyway.

Improve this answer
3
  • Ok I understood what you suggest. Nevertheless I still have a big question. Not knowing any other way, I get the token by showing a webView in a Fragment that handles the calls as a browser. When you say re-authenticate do you imply to show that view again? I dont think thats the way other apps are doing it. What am I missing? – Marco Pierucci Oct 31 '16 at 17:45
  • 1
    Yes, pretty sure you show that webview again. At this point, the API doesn't know or care that you'd previously authenticated. I may be wrong as I'm not an Android developer, but the code I do know just recalls the same routine as for the original login. Try it and see what happens. – Brock Adams Oct 31 '16 at 17:52
  • Ok makes sense, Ill be trying that out. Thanks! – Marco Pierucci Oct 31 '16 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .