<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>This shows using the token endpoint to side-scope a refresh token to get a id_token with a 3rd party audience using the Google Play example, then using the JWT assertion flow to exchange the id_token for a access token.</div><div><br></div><div>This is the Google developer spec for the Play Method <a href="http://android-developers.blogspot.com/2013/01/verifying-back-end-calls-from-android.html">http://android-developers.blogspot.com/2013/01/verifying-back-end-calls-from-android.html</a></div><div>They don't have there Token Agent do the swap for a access token, they are handing the id_token to the app and letting it use it as an access token or exchange it in some way.</div><div><br></div><div>The other possibility may be to have the Appinfo endpoint return the id_token along with meta-data about what 3rd party Token endpoint needs to be used to exchange the id_token/JWT assertion.</div><div>This may work better if the Token Agent is doing the exchange rather than the app.</div><div><br></div><div><br></div><div>For those not part of the Connect WG we deliberately the id_token the same format as a JWT for use in assertions. </div><div><br></div></body></html>