Take the 2-minute tour ×  I'm developing a mobile app that has
to talk to it's own custom back-end API. I would prefer to not
roll my own authentication and account management, I would
rather use Oauth2 from an existing provider.  Google allows you
to validate Google generated Oauth tokens server side without
needing to call Google's servers. This is important, since I'll
be authenticating each request separately. If the server needed
to call an external service to verify a token each time, the
service will be slower and harder to scale. Google mentions how
to verify their tokens in this section: Validating Tokens
.Except for the need to refresh Google's certs roughly once a
day, you can validate a Google generated OAuth token on your own
server alone.  My question is, are there other OAuth providers
that don't require an extra call to validate a token? It appears
for both Facebook and Twitter you need to call their server to
validate a token. Since these tokens have an expiration time, is
it considered a goo