HTTP Get Request with authentification Android

Question

I am trying to connect to a REST api of my stormpath authentification server from my android client. Stormpath has a java library however I am not able to get the custom data, therefore the only i found to actually get this data is by calling the REST API.

On their website

They talk about authentifiaction and give a simple linux command:

curl --request GET \
--user $SP_API_KEY_ID:$SP_API_KEY_SECRET \
--header 'content-type: application/json' \
--url "https://api.stormpath.com/v1/tenants/current"

How could i translate that to android ? I have tried like this but without any success:

try {
            URL url = new URL((String) params[1]);
            HttpURLConnection conn = (HttpURLConnection) url.openConnection();
            conn.setRequestMethod("GET");
            conn.setRequestProperty("Accept", "application/json");

            if (conn.getResponseCode() != 200) {
                throw new RuntimeException("Failed : HTTP error code : "
                        + conn.getResponseCode());
            }

            BufferedReader br = new BufferedReader(new InputStreamReader(
                    (conn.getInputStream())));

            String output;
            System.out.println("Output from Server .... \n");
            while ((output = br.readLine()) != null) {
                Log.d("DEBUG", "" + output);
            }

            conn.disconnect();

        } catch (MalformedURLException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        }

Answer 1

Full disclosure: I work @ Stormpath (though not directly on our Android stuff).

There's two separate use cases we support, which we can do a better job of documenting:

• Trusted communication with the Stormpath REST API. This requires a Stormpath API key ID and secret and should not be done from a mobile or web client.
• Untrusted communication with the Stormpath Client API or one of our server middleware packages.

For an Android client, you don't want to make calls using trusted API credentials, because someone could steal them by decompiling your app. Instead, you should create a route on your backend server to make trusted calls to the Stormpath API, and relay that data to your app.