this is what I ended up doing (using https://github.com/dgrijalva/jwt-go):
package XXX
import (
"errors"
oauth2 "code.google.com/p/google-api-go-client/oauth2/v2"
"jwt"
"appengine"
"appengine/urlfetch"
)
func getTokeninfo(c appengine.Context, token string) (*oauth2.Tokeninfo, error) {
client := urlfetch.Client(c)
oauth2Svc, err := oauth2.New(client)
if err != nil {
return nil, err
}
return oauth2Svc.Tokeninfo().Id_token(token).Do()
}
func verifyToken(c appengine.Context, token string) (string, error) {
parsedToken, err := jwt.Parse(token)
if err != nil {
c.Debugf(err.Error())
return "", err
}
if parsedToken.Claims["aud"] != "XXX.apps.googleusercontent.com" {
c.Debugf("aud mismatch")
return "", errors.New("Aud mismatch")
}
if (parsedToken.Claims["azp"] != "XXX.apps.googleusercontent.com") &&
(parsedToken.Claims["azp"] != "XXX.apps.googleusercontent.com") {
c.Debugf("azp mismatch")
return "", errors.New("Azp mismatch")
}
ti, err := getTokeninfo(c, token)
if err != nil {
c.Debugf(err.Error())
return "", err
}
if (ti.Issued_to != "XXX.apps.googleusercontent.com") &&
(ti.Issued_to != "XXX.apps.googleusercontent.com") {
c.Debugf("cid mismatch")
return "", errors.New("Client ID mismatch")
}
return ti.User_id, nil
}