We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication on subsequent requests. The server will store a hashed version of this token in the database with the user.
We want to make sure that authenticating the token takes as little time as possible.
What kind of hashing/encryption is sufficient to store the tokens in the database? Is a fast hash such as SHA256 good enough, or should we use a slow hash such as bcrypt? If using SHA256, do we need to include a salt, since the original unhashed token is just a random 16 byte UUID?