How do I send user credentials and get the access token?
Moqbel,
Here is a Drupal 8 Android app code that uses Android accountManager to send user credentials and get the access token. https://github.com/onedrupal/One-Drupal-Android

Whan a token is expired, AccountManager can be used to get a fresh token.
https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/activities/ActivityAuthentication.java At the launch of the activity AccountManager.getAuthTokenByFeatures is called

mAccountManager.getAuthTokenByFeatures(AccountUtils.ACCOUNT_TYPE, AccountUtils.AUTH_TOKEN_TYPE, null, this, null, null, new ActivityAuthentication.GetAuthTokenCallback(), null);


Here is the AccountAuthenticator https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/authenticator/AccountAuthenticator.java

authToken = AccountUtils.mServerAuthenticator.signIn(site_protocol+site_domain, account.name, password);


It uses cookie auth by using endpoint /user/login?_format=json at https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/provider/MyServerAuthenticator.java

But Android AccountManager also works with OAuth.

from https://developer.android.com/training/id-auth/authenticate


  The only way to discover whether a token is expired or not is to
  contact the server, and it would be wasteful and expensive for
  AccountManager to continually go online to check the state of all of
  its tokens.
  
  Because expired tokens are such a common occurrence, and fixing them
  is so easy, many applications just assume the token has expired before
  even asking for it. If renewing a token is a cheap operation for your
  server, you might prefer to call AccountManager.invalidateAuthToken()
  before the first call to AccountManager.getAuthToken(), and spare
  yourself the need to request an auth token twice.