I want to use firebase auth for my android and ios applications with custom backend. So I need some way of authentication for api calls from mobile apps to the backend.
I was able to find following guide in firebase documentation which suggests to sent firebase id token to my backend and validate it there with firebase Admin SDK. https://firebase.google.com/docs/auth/admin/verify-id-tokens
But this approach does not seem to be a security best practice. For example here https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/ it is said that for API access one should use access tokens rather than id tokens.
Are there any good pattern for using firebase auth with my backend?