I'm building an app where the users should have restricted access to certain api-services. I use
gRPC as API. Right now I'm asking the user's mobile number, send him an SMS with a code which he has to verify. If it's the same, the backend generates an UUID which will be sent to the user and safed in a local database on the mobile phone. The user is then able to authenticate itself on the backend by just sending the UUID.
While I'm in that process I noticed that the Firebase Token also never changes so I have two unique id's which are saved in the database.
Is it safe to skip the generation of an extra UUID and verify the user by it's Firebase Token/UID, only? The client could send the verification code with the Firebase Token and if the Firebase Token is correct, the backend will save this token to the database. The client can then authorize itself with that token. Or do I miss a point here?