What Is The Recommended Way Of Authentication After Google+ Signin?

I'm following the latest Google+ Sign-in integration for my app (https://developers.google.com/+/mobile/android/sign-in), which says The Google+ Sign-In button authenticates the

Solution 1:

If all you need is authentication to your own server (rather than access to any Google hosted information), you can use the Using Google Sign-In with your server techniques, which allows you get tokens with the new Google Sign In API:

 GoogleSignInOptions gso = 
     new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)  
   .requestIdToken(getString(R.string.server_client_id))  
   .requestEmail()  
   .build(); 

Where the server_client_id is a OAuth 2.0 client ID for web applications from the Credentials page. You'll then get the id token from googleSignInResult.getSignInAccount().getIdToken().

You can then verify the id token on your server side and you'll know the user's email address and that the request is coming from your Android app.

The documentation runs through the full workflow, including pointing out the GoogleIdTokenVerifier class which can make verifying the token much easier.