What you are referring to isn't part of the OAuth spec, as far as I know, is it something particular to Google's API? The cached access token could also be con

What you are referring to isn't part of the OAuth spec, as far as I know, is it something particular to Google's API? The cached access token could also be considered a factor, although it depends on the token expiry policy. If the token doesn't require a refresh using a refresh token (which must prompt a password) often enough its security is compromised. I don't know what kind of expiry Google's OAuth token has, but last time I tested this, it was a very long time. I believe Twitter's live forever. Facebook's offline access scope (which you will need for a normal app) lives forever until the user changes his/her password (see http://developers.facebook.com/blog/post/2011/05/13/how-to--handle-expired-access-tokens/ http://developers.facebook.com/blog/post/2011/05/13/how-to--...).