title: How can I verify a Google authentication API access token?
body: <p><strong>How can I verify a Google authentication access token?</strong></p>
  <p><strong>I need to somehow query Google and ask: Is [given access token] valid for the [example@example.com] Google account?</strong></p>
  <h2>Short version</h2>
  <p>It's clear how an access token supplied through the <a href="https://code.google.com/apis/accounts/docs/OAuth.html" rel="noreferrer">Google Authentication Api :: OAuth Authentication for Web Applications</a> can be used to then request data from a range of Google services. It is not clear how to check if a given access token is valid for a given Google account. I'd like to know how.</p>
  <h2>Long version</h2>
  <p>I'm developing an API that uses token-based authentication. A token will be returned upon provision of a valid username+password or upon provision of a third-party token from any one of <i>N</i> verifiable services.</p>
  <p>One of the third-party services will be Google, allowing a user to authenticate against my service using their Google account. This will later be extended to include Yahoo accounts, trusted OpenID providers and so on.</p>
  <p><strong>Schematic example of Google-based access:</strong></p>
  <p><img src="https://webignition.net/images/figures/auth_figure002.png" alt="alt text" /></p>
  <p>The 'API' entity is under my full control. The 'public interface' entity is any web- or desktop-based app. Some public interfaces are under my control, others will not be and others still I may never even know about.</p>
  <p>Therefore I cannot trust the token supplied to the API in step 3. This will be supplied along with the corresponding Google account email address.</p>
  <p>I need to somehow query Google and ask: <em>Is this access token valid for example@example.com</em>?</p>
  <p>In this case, example@example.com is the Google account unique identifier - the email address someone uses to log in to their Google account. This cannot be assumed to be a Gmail address - someone can have a Google account without having a Gmail account.</p>
  <p>The Google documentation clearly states how, with an access token, data can be retrieved from a number of Google services. Nothing seems to state how you can check if a given access token is valid in the first place.</p>
  <p><strong>Update</strong>
  The token is valid for N Google services. I can't try a token against a Google service as means of verifying it as I won't know which subset of all Google's services a given user actually uses.</p>
  <p>Furthermore, I'll never be using the Google authentication access token to access any Google services, merely as a means of verifying a supposed Google user actually is who they say they are. If there is another way of doing this I'm happy to try.</p>