How do I send user credentials and get the access token? I am linking a Drupal site to an Android application. With the help of the Simple OAuth module, users will log in to my android app using their Drupal site credentials. 

I understand that once the client application has the access token, it can be  included in the headers of any GET request to fetch JSON content from Drupal. I also know that https://example.com//simple-oauth/refresh will give a new access token, having the refresh token. 

What should I do if both access and the refresh tokens are already expired?
How do I get them from scratch?
What is the URL to ask for the token, and how do I include the credentials with that via HTTP headers or in the URL?

Is there something I'm not aware of about this way of authenticating?
Moqbel,
Here is a Drupal 8 Android app code that uses Android accountManager to send user credentials and get the access token. https://github.com/onedrupal/One-Drupal-Android

Whan a token is expired, AccountManager can be used to get a fresh token.
https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/activities/ActivityAuthentication.java At the launch of the activity AccountManager.getAuthTokenByFeatures is called

mAccountManager.getAuthTokenByFeatures(AccountUtils.ACCOUNT_TYPE, AccountUtils.AUTH_TOKEN_TYPE, null, this, null, null, new ActivityAuthentication.GetAuthTokenCallback(), null);


Here is the AccountAuthenticator https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/authenticator/AccountAuthenticator.java

authToken = AccountUtils.mServerAuthenticator.signIn(site_protocol+site_domain, account.name, password);


It uses cookie auth by using endpoint /user/login?_format=json at https://github.com/onedrupal/One-Drupal-Android/blob/master/app/src/main/java/com/technikh/onedrupal/provider/MyServerAuthenticator.java

But Android AccountManager also works with OAuth.

from https://developer.android.com/training/id-auth/authenticate


  The only way to discover whether a token is expired or not is to
  contact the server, and it would be wasteful and expensive for
  AccountManager to continually go online to check the state of all of
  its tokens.
  
  Because expired tokens are such a common occurrence, and fixing them
  is so easy, many applications just assume the token has expired before
  even asking for it. If renewing a token is a cheap operation for your
  server, you might prefer to call AccountManager.invalidateAuthToken()
  before the first call to AccountManager.getAuthToken(), and spare
  yourself the need to request an auth token twice.