4

I'm trying to learn how to implement an OAuth flow in an Android app using a simple app with the Stack Exchange API.

Using WebView, I'm able to retrieve an access token and store it in my shared preferences. My doubt is how to deal with token expiration.

I don't think I'm supposed to show the WebView again, am I?

Improve this question
0

1 Answer 1

Reset to default
4

Dealing with token expiration is pretty simple.
When a token is/goes bad then, when you make an API call that uses the token, you will get a JSON response like this:

{
    "error_id": 403,
    "error_message": "`key` is not valid for passed `access_token`, token not found.",
    "error_name": "access_denied"
}

At that point, just re-authenticate.

You can also pre-check a token using the /access-tokens/{accessTokens} route but that's overkill in must scenarios.

I don't recommend using a no_expiry token, for security reasons, and even such tokens can be invalidated. So, your app needs to know how to handle bad tokens anyway.

Improve this answer
2
  • Ok I understood what you suggest. Nevertheless I still have a big question. Not knowing any other way, I get the token by showing a webView in a Fragment that handles the calls as a browser. When you say re-authenticate do you imply to show that view again? I dont think thats the way other apps are doing it. What am I missing?
    – Marco Pierucci
    Oct 31, 2016 at 17:45
  • 1
    Yes, pretty sure you show that webview again. At this point, the API doesn't know or care that you'd previously authenticated. I may be wrong as I'm not an Android developer, but the code I do know just recalls the same routine as for the original login. Try it and see what happens.
    – Brock Adams
    Oct 31, 2016 at 17:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .