How to instantiate GoogleIdTokenVerifier properly / what does .setAudience() do?

Question

My Guidelines

If followed this Google documentation about verifying Google-Account-Tokens on the server side, but I am kinda confused.

My Problem

GoogleIdTokenVerifier googleIdTokenVerifier = new GoogleIdTokenVerifier.Builder(new NetHttpTransport(), new JacksonFactory())
                                .setAudience(Collections.singletonList(CLIENT_ID))
                                .build();

In this piece of code I figured out that the transport and jsonFactory arguments can be filled as new NetHttpTransport() and new JacksonFactory() here. It also describes how to get AudienceString, but I couldn't figure out what it is for. I couldn't test it, but my question is if I can use it without .setAudience() or if I need it and what it is for.

Answer 1

In .setAudience() you have to pass all client ID's. You can get the ID for your client from the Credentials Page. It's explained here.

Thanks to @StevenSoneff.

If you didn't get the basic concept

For every client you want your server to accept, you need to create a project in the `Developer Console`. Clients are differentiated by their `SHA-1` fingerprint. You can for example have a debug project (will take your debug fingerprint) and a release one. To make both work, you have to add both `ID`'s to your server's `GoogleIdTokenVerifier`'s `.setAudience()`.