How to check Firebase auth on backend?

Question

PHP

I do authorization by phone number as described in the Firebase tutorial, but apparently I don’t catch up with something
1. I send the number

firebase.auth().signInWithPhoneNumber(phoneNumber, appVerifier)
            .then(function (confirmationResult) {
          
            window.confirmationResult = confirmationResult;
            //Отправили смс
               
            }).catch(function (error) {
                console.log('error',error);
                
            // Error; SMS not sent
            // ...
            });

2. I check the code that the user entered

confirmationResult.confirm(code_from_sms).then(function (result) {
        // User signed in successfully.
        var user = result.user;
        console.log('code confirm',user,result);
        firebase.auth().currentUser.getIdToken(false).then(function (idToken) {

               //Тут получили idToken, и что дальше????

                }).catch(function (error) {
                console.log('currentUser error',error);
                });
     
        }).catch(function (error) {
        // User couldn't sign in (bad verification code?)
        console.log('code error confirm',error);
        // ...
        });

All this is fine, JavaScript returned to us that the user is authorized, then what should I do with this knowledge?
I need, for example, to create a session in the backend after the user is authorized in the frontend, i.e. I have to double-check the data that the frontend returned on the backend, namely, make a request to Firebase whether it exactly authorized the user ... I can’t rely on Javascript callbacks ...

Can I check the correctness of the code from the SMS on the server side, for example, curl ?

Answer 1

After authorization, you have a token from Google. On the backend, you can check it through the library: https://firebase-php.readthedocs.io/en/stable/auth...