Google sign-in using AppAuth and cross-client identity -

i using appauth implement google sign-in. app authenticate. need id_token server can communicate server app. believe need include audience:server:client_id:web_client_id shown in following link.

https://developers.google.com/identity/sign-in/android/v1/backend-auth

more information available here: https://developers.google.com/identity/protocols/crossclientauth

how can use web client id app id_token can reliably communicate server using token?

the scope audience:server:client_id:web_client_id specific android. ios need send audience=web_client_id parameter token endpoint.

it works in case using following code.

oidserviceconfiguration *configuration = [[oidserviceconfiguration alloc] initwithauthorizationendpoint:authorizationendpoint tokenendpoint:tokenendpoint];  // builds authentication request oidauthorizationrequest *authorizationrequest = [[oidauthorizationrequest alloc] initwithconfiguration:configuration                                               clientid:kclientid                                                 scopes:@[oidscopeopenid,                                                          oidscopeemail]                                            redirecturl:[nsurl urlwithstring:kredirecturi]                                           responsetype:oidresponsetypecode                                   additionalparameters:nil];  // performs authentication request oidauthorizationuicoordinatorios *coordinator = [[oidauthorizationuicoordinatorios alloc]                                                  initwithpresentingviewcontroller:self]; id<oidauthorizationflowsession> authflowsession = [oidauthorizationservice                                                    presentauthorizationrequest:authorizationrequest                                                    uicoordinator:coordinator                                                    callback:^(oidauthorizationresponse *_nullable authorizationresponse,                                                               nserror *_nullable authorizationerror) {                                                        // inspects response , processes further if needed (e.g. authorization                                                        // code exchange)                                                        if (authorizationresponse) {                                                            if ([authorizationrequest.responsetype                                                                 isequaltostring:oidresponsetypecode]) {                                                                // if request code flow (nb. not hybrid), assumes                                                                // code intended client, , performs authorization                                                                // code exchange                                                                 oidtokenrequest *tokenexchangerequest =                                                                [[oidtokenrequest alloc] initwithconfiguration:authorizationrequest.configuration                                                                                                     granttype:oidgranttypeauthorizationcode                                                                                             authorizationcode:authorizationresponse.authorizationcode                                                                                                   redirecturl:authorizationrequest.redirecturl                                                                                                      clientid:authorizationrequest.clientid                                                                                                  clientsecret:authorizationrequest.clientsecret                                                                                                         scope:authorizationrequest.scope                                                                                                  refreshtoken:nil                                                                                                  codeverifier:authorizationrequest.codeverifier                                                                                          additionalparameters:@{@"audience":kwebclientid}];                                                                //tokenexchangerequest.scope = kaudienceserverclientid;                                                                 [oidauthorizationservice                                                                 performtokenrequest:tokenexchangerequest                                                                 callback:^(oidtokenresponse *_nullable tokenresponse,                                                                            nserror *_nullable tokenerror) {                                                                     oidauthstate *authstate;                                                                     if (tokenresponse) {                                                                         authstate = [[oidauthstate alloc]                                                                                      initwithauthorizationresponse:                                                                                      authorizationresponse                                                                                      tokenresponse:tokenresponse];                                                                     }                                                                      [self onsigninresponse:authstate error:tokenerror];                                                                 }];                                                            } else {                                                                // implicit or hybrid flow (hybrid flow assumes code not                                                                // client)                                                                oidauthstate *authstate = [[oidauthstate alloc]                                                                                           initwithauthorizationresponse:authorizationresponse];                                                                 [self onsigninresponse:authstate error:authorizationerror];                                                            }                                                        } else {                                                            [self onsigninresponse:nil error:authorizationerror];                                                        }                                                    }];  myappdelegate *appdelegate = [myappdelegate sharedinstance]; appdelegate.currentauthorizationflow = authflowsession;