I have a client – server – firebase architecture. My server forwards firebase auth token like this:

    //signInWithEmailAndPassword.then....
    const token = userCredential.user.getIdToken();
    res.status(200).send({
        token,
    });

When the client wants to use a protected resource and send back the auth token, how do I verify it on the server side?