title: Programming Flow with Signin with google
body: <p>I am trying to write a web app which uses <strong>sign in with google</strong>. I am a bit confused about the sequence of steps which should be followed. According to google docs , the normal flow for signing in a user is:</p>
  
  <p><a href="https://i.stack.imgur.com/wyuwB.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wyuwB.png" alt="recommended flow for signing in a user"></a></p>
  
  <p>What i intend to figure out is:</p>
  
  <p>1.) Am i supposed to send the IdToken with each and every subsequent API request from web to my server.</p>
  
  <p>2.) what to do if someone steals this access token and sends a call to my server with it?</p>