title: How to fix the "Malformed auth code" when trying to refreshToken on the second attempt?
body: <p>I'm developping an Android App with Angular and Cordova plugins and I want to integrate it with Google Authentication.
  I have installed the <a href="https://github.com/EddyVerbruggen/cordova-plugin-googleplus" rel="noreferrer">cordova-plugin-googleplus</a>  and I have successfully integrated into the application.
  When the user logs in, I get a response where I can get accessToken, profile user information and refreshToken.</p>
  
  <p>Now I want to implement a feature to refresh the token without disturbing the user with a new prompt screen every hour.</p>
  
  <p>I have managed to renew accessToken, but it only works the first time</p>
  
  <p>I have used these two ways:</p>
  
  <ol>
  <li>Sending a curl request with the following data</li>
  </ol>
  
  <pre><code>curl -X POST \
    'https://oauth2.googleapis.com/token?code=XXXXXXXXXXXXXXXX&amp;client_id=XXXXXXXXXXXXXXXX.apps.googleusercontent.com&amp;client_secret=YYYYYYYYYYYY&amp;grant_type=authorization_code' \
    -H 'Cache-Control: no-cache' \
    -H 'Content-Type: application/x-www-form-urlencoded'
  </code></pre>
  
  <ol start="2">
  <li>Implementing it on the server side using the Google API Client Library for Java and following mainly these <a href="https://googleapis.dev/java/google-api-client/latest/com/google/api/client/googleapis/auth/oauth2/GoogleAuthorizationCodeTokenRequest.html" rel="noreferrer">code</a> </li>
  </ol>
  
  <p>The point is that when the user logs in for the first time (using the cordova-plugin-googleplus), I receive a refreshToken with this format</p>
  
  <pre><code>4/rgFU-hxw9QSbfdj3ppQ4sqDjK2Dr3m_YU_UMCqcveUgjIa3voawbN9TD6SVLShedTPveQeZWDdR-Sf1nFrss1hc
  </code></pre>
  
  <p>If after a while I try to refresh the token in any of the above ways I get a successful response with a new accessToken, and a new refreshToken. And that new refreshToken has this other format</p>
  
  <pre><code>1/FTSUyYTgU2AG8K-ZsgjVi6pExdmpZejXfoYIchp9KuhtdknEMd6uYCfqMOoX2f85J
  </code></pre>
  
  <p>In the second attempt to renew the token, I replace the token with the one returned in the first request  </p>
  
  <pre><code>curl -X POST \
    'https://oauth2.googleapis.com/token?code=1/FTSUyYTgU2AG8K-ZsgjVi6pExdmpZejXfoYIchp9KuhtdknEMd6uYCfqMOoX2f85J&amp;client_id=XXXXXXXXXXXXXXXX.apps.googleusercontent.com&amp;client_secret=YYYYYYYYYYYY&amp;grant_type=authorization_code' \
    -H 'Cache-Control: no-cache' \
    -H 'Content-Type: application/x-www-form-urlencoded'
  </code></pre>
  
  <p>But this time, both ways (Curl and Java) I am getting the same error. </p>
  
  <pre><code>{
    "error" : "invalid_grant",
    "error_description" : "Malformed auth code."
  }
  </code></pre>
  
  <p>I read on this <a href="https://stackoverflow.com/a/19041051/12155976">thread</a> that was a problem to specify the clientId as an email, but I have not discovered how to solve it either because the first login it's done with the client id 'XXXXXXX.apps.googleusercontent.com' and if I set an email from the google accounts it says that is an "Unknown Oauth Client"</p>
  
  <p>I hope any can help me with this, as I'm stuck for several days</p>