I'm developing a website that is primarily accessed via an app, and I want to use OAuth2 for user registration and authentication. Since it is an Android app I will start using Google's OAuth2 stuff, since it provides a decent UI on Android.
Google states that "You can choose to use Google's authentication system as a way to outsource user authentication for your application. This can remove the need to create, maintain, and secure a username and password store." which is what I want to do. However when I go through all their examples and whatnot, I can only find stuff about having a website or an app authenticate a user against Google's services.
And indeed, when I go to register my app ("client") with Google's OAuth2 there are options for website clients and "installed" clients (i.e. a mobile app) but not both. I can create two separate clients but I read the OAuth2 draft and I think there will be a problem, which I will now explain.
Here's how I did envisage it working:

- User asks MyApp to access his private data.
- App uses Android's
AccountManagerclass to request an access token for Google's APIs. - Android says to user "The app 'MyApp' wants access to your Basic Information on Google. Is this ok?"
- User says yes.
AccountManagerconnects to Google's OAuth2 server using the credentials stored on the phone, and asks for an access token.- Access token (which follows the green lines) is returned.
AccountManagerreturns the access token to MyApp.- MyApp sends a request to MySite for the user's private data, including the access token.
- MySite needs to verify the user, using the access token. It validates the token android oauth oauth-2.0 google-authentication