Q:

Using Google OAuth2 token to access protected Web Api

I want to add social signin to my Apache Cordova app.
OAuth 2.0 specifies four roles: Resource Owner, Client, Resource Server and Authorization Server.
As I understand it:
Resource Owner - me

Client - my JavaScript application running in Cordova.

Authorization Server - Google's OAuth2 implementation (https://accounts.google.com/o/oauth2/auth?...)

Resource Server - an ASP.NET Web Api.

I'm successfully getting a Google access token from my client application, but what is completely unclear to me is how I might use / decrypt this in the Web Api to identify the user.

A:

The Google access token is intended to be used against Google APIs, not against yours. For example you could use this token to query information about the resource owner. If you want to protect your WebAPI using OAuth then you will need an authorization server that issues access tokens for it and which your API could use to validate.

