As done in JS with PR, iOS version need validating token too. https://github.com/aerogear/aerogear-js/pull/93 See: https://developers.google.com/accounts/docs/OAuth2UserAgent#validatetoken