title: Login via Google: what to do after getting access token?
body: <p>I am learning to build a Login via Google button on my Joomla website, and I am following instruction on <a href="https://developers.google.com/identity/protocols/oauth2/web-server" rel="nofollow noreferrer">https://developers.google.com/identity/protocols/oauth2/web-server</a>.</p>
  <p><strong>A little background:</strong>
  I am using a third party extension to handle social login. Its facebook login works well, but its google login is outdated, still trying to connect to Google Plus endpoints. Clicking the login button on my page does lead to Google's account choice screen, after I choose an account and grant permission, there is a simple error message on the callback page. The author has stopped updating the extension, so for learning purpose, I've decided to fix it myself.</p>
  <p><strong>What I've achieved:</strong>
  Currently I was able to get the access token from Google.</p>
  <pre><code>.......
  $postdata = array(
                  'grant_type'    =&gt;'authorization_code',
                  'client_id'     =&gt; $this-&gt;params-&gt;get('goappid'),
                  'client_secret' =&gt; $this-&gt;params-&gt;get('gosecret'),
                  'redirect_uri'  =&gt; $this-&gt;getRedirectURL().'&amp;task=gologin',
                  'code'          =&gt; $_GET['code']);
  
              curl_setopt($curl, CURLOPT_URL, 'https://oauth2.googleapis.com/token');
              curl_setopt($curl, CURLOPT_HTTPHEADER, array('Content-type: application/x-www-form-urlencoded'));
              curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($postdata));
  
              $oauth = json_decode(curl_exec($curl));
  
          //  Above code seems to be fine,  getting $oauth response as follows
          //   &quot;access_token&quot;: &quot;token string&quot;,
          //   &quot;expires_in&quot;: 3599,
          //   &quot;scope&quot;: &quot;https://www.googleapis.com/auth/userinfo.profile&quot;,
          //   &quot;token_type&quot;: &quot;Bearer&quot;,
          //  &quot;id_token&quot;:&quot;token string&quot; 
  
              if (isset($oauth-&gt;access_token)) {
                  curl_setopt($curl, CURLOPT_POST, false);
                  curl_setopt($curl, CURLOPT_URL, 'https://www.googleapis.com/plus/v1/people/me?access_token='.$oauth-&gt;access_token);  //Apparently outdated endpoint
  
                  $user = json_decode(curl_exec($curl));
  
                  if (empty($user-&gt;error)) {
                      curl_setopt($curl, CURLOPT_URL, 'https://www.googleapis.com/plus/v1/people/me/activities/public?access_token='.$oauth-&gt;access_token);//Apparently outdated endpoint
  </code></pre>
  <p><strong>My question:</strong> At this point, I don't know what to do. The <a href="https://developers.google.com/identity/protocols/oauth2/web-server#callinganapi" rel="nofollow noreferrer">instruction</a> says <code>After your application obtains an access token, you can use the token to make calls to a Google API on behalf of a given user account</code>, but how do I &quot;make calls to a Google API&quot;? To make a simple login via Google button, which API should I call? And to what endpoint should I make the request? I can't find this information from the instruction page. Above code is making request to <a href="https://www.googleapis.com/plus/v1/people/me?access_token" rel="nofollow noreferrer">https://www.googleapis.com/plus/v1/people/me?access_token</a>, which is obviously outdated but how should I change this? This should have been provided by the instruction but I couldn't find it. And if I want to access other Google APIs, how do I &quot;make calls&quot; to them? a.k.a where do I find endpoints for each API?</p>
  <p>I've also read <a href="https://developers.google.com/identity/protocols/oauth2/openid-connect" rel="nofollow noreferrer">https://developers.google.com/identity/protocols/oauth2/openid-connect</a>, is what I am trying to do considered OIDC? Should I proceed according to this document?</p>