title: How to use google python oauth libraries to implement OpenID Connect?
body: <p>I am evaluating different options for authentication in a python App Engine flex environment, for apps that run within a G Suite domain.</p>
  
  <p>I am trying to put together the OpenID Connect "Server flow" instructions <a href="https://developers.google.com/identity/protocols/OpenIDConnect" rel="nofollow noreferrer">here</a> with how <a href="https://github.com/GoogleCloudPlatform/google-auth-library-python" rel="nofollow noreferrer">google-auth-library-python</a> implements the general OAuth2 instructions <a href="https://developers.google.com/identity/protocols/OAuth2WebServer" rel="nofollow noreferrer">here</a>.  </p>
  
  <p>I kind of follow things up until <strong>4. Exchange code for access token and ID token</strong>, which looks like <code>flow.fetch_token</code>, except it says "response to this request contains the following fields in a JSON array," and it includes not just the access token but the id token and other things. I did see <a href="https://github.com/GoogleCloudPlatform/google-auth-library-python/pull/234" rel="nofollow noreferrer">this patch to the library</a>. Does that mean I could use some <code>flow.fetch_token</code> to create an <code>IDTokenCredentials</code> (how?)  and then use this to build an OpenID Connect API client (and where is that API documented)?  And what about validating the id token, is there a separate python library to help with that or is that part of the API library?</p>
  
  <p>It is all very confusing. A great deal would be cleared up with some actual "soup to nuts" example code but I haven't found anything anywhere on the internet, which makes me think (a) perhaps this is not a viable way to do authentication, or (b) it is so recent the python libraries have not caught up?  I would however much rather do authentication on the server than in the client with Google Sign-In.</p>
  
  <p>Any suggestions or links to code are much appreciated.</p>