token_handling.java

    public Interceptor getAccessTokenInterceptor() {
        return new Interceptor() {
            @Override
            public okhttp3.Response intercept(Chain chain) throws IOException {
                Request request = chain.request();

                request = request.newBuilder()
                        .header("X-Android-Package", app.getPackageName())
                        .header("X-Android-Cert", app.getSignature())
                        .header("Authorization", "Bearer " + getAccessToken())
                        .build();

                Log.i(TAG, "token: " + getAccessToken());

                return chain.proceed(request);
            }
        };
    }
    
    private UserInfoAPI createUserInfoAPI() {
        HttpLoggingInterceptor logger = new HttpLoggingInterceptor();
        logger.setLevel(HttpLoggingInterceptor.Level.BODY);

        OkHttpClient authClient = new OkHttpClient().newBuilder()
                .addInterceptor(getAccessTokenInterceptor())
                .addInterceptor(logger)
                .build();

        Gson gson = new GsonBuilder().setLenient().create();
        Retrofit retrofit = new Retrofit.Builder()
                .baseUrl(userInfoUrl)
                .client(authClient)
                .addConverterFactory(GsonConverterFactory.create(gson))
                .build();

        return retrofit.create(UserInfoAPI.class);
    }