I've just begun work on a new web application and I wanted to implement account creation/logins using google's OAuth flow. I noticed that they're discontinuing the API most people are using. https://developers.google.com/identity/sign-in/web/sign-in. I'm trying to understand how the flow for then new API (https://developers.google.com/identity/gsi/web) works.
From what I've tried, that API just responds with a single access token, which is fine for the 15 minutes it's valid for, but I don't want my users to have to go through the login process every time they revisit the site. There doesn't seem to be a method in the API for refreshing the access token without the user having to be involved.
I feel like I'm missing a step because this doesn't feel like a replacement for the existing API at all.
Basically I'm asking if this new API has any session management capabilities. If it doesn't should I just use the deprecated API for now?
To get an overview of what is taking place during sign-in, imho it would be worth the five minutes or less it takes to read How it works to build a high level understanding of what's going on.
In answer to your specific questions:
Access tokens are no longer used, and neither are refresh tokens. A JWT ID token is shared instead. JWTs do not expire, but are signed and you'll want to validate them. The token response section of the migration guide has more detail on the switch to JWT's.
For session state you'll want to be aware that there are two session states 1) between the user and their Google account 2) the user and your app. The two are independent. The previous library included some helper functions to help you look at 1, but one side-effect was it made the distinction between 1 & 2 hazy and unclear. Session state and Listeners has more.