title: Google play services returning a token signed with a non-Google key
body: <p>I have an Android client getting an authentication token from Google Play Services, by using <code>GoogleAuthUtil.getToken(Context context, Account account, String scope)</code>.</p>
  
  <p>This is then sent to a backend (Go) server, which checks that the token was signed by one of the Google signing certificates from <a href="https://www.googleapis.com/oauth2/v1/cert" rel="noreferrer">https://www.googleapis.com/oauth2/v1/cert</a>.  To do this, it needs to look up the certificate assigned to the "kid" in the token header.</p>
  
  <p>99% of the time, this works just fine, but I have regular situations where the "kid" given does not correspond to any published Google certificates, and so I can't auth the token.</p>
  
  <p><em>Edit:</em></p>
  
  <p>I've added extensive logging on the server to try and track this down, and there are some relationships worth noting:</p>
  
  <ol>
  <li>Any given invalid <code>kid</code> is only used for a single user.  I often see multiple requests over several days from the same user with a given invalid <code>kid</code>, but only ever from that user.</li>
  <li>A user giving an invalid <code>kid</code> never uses a valid <code>kid</code> for any request, or any other <code>kid</code> for a request, even if they are days apart.  Afaik Google cycles their certificates every 24 hours or so.</li>
  <li>Many users are using older client versions. Most users upgrade within a day or two of a new version being released, but the majority of users with invalid certificate keys use versions that are a few weeks old.</li>
  <li>The requests come from an even spread around the globe in line with our user base.</li>
  <li>The requests come from a spread of times, in line with our user base.</li>
  <li>The requests come from a range of devices, manufacturers, and models.</li>
  </ol>
  
  <p>My current thoughts are that it's probably from users who have downloaded the APK from a site other than Google Play, but I have no way of verifying this right now.</p>
  
  <p>Edit:  There is an issue tracker for this, but it seems that it has been marked as a low priority. If anyone has this issue, please let it be know on the tracker. <a href="https://issuetracker.google.com/issues/37734997" rel="noreferrer">https://issuetracker.google.com/issues/37734997</a></p>