Proper way to authenticate with a backend server
<p>According to the <a href="https://developers.google.com/identity/sign-in/android/backend-auth#send-the-id-token-to-your-server" rel="nofollow">doc</a>, in order to authenticate with a backend server I have to : </p>

<ul>
<li>send the user's ID token to my server using HTTPS. </li>
<li>verify the integrity of the ID token and retrieve the user's ID from the sub claim of the ID token. </li>
</ul>

<p>This work quite well, but how to do if I have to authenticate all the request to the server ? </p>

<p>Should I store the idToken (on a private sharred preferences) and verify it each time server side ? Since the idToken have a validity date, the client must be able to regenerate it when it has expired.</p>

<p>Or on the first connection, should I return a single id (without validity date) to the user which will allow him to communicate with the server (seems less secure) ?</p>