title: Firebase: Need to prove authorization to an API
body: <p>I have a custom REST API that takes in user/password and I see how I can use that API to generate and return a custom token that the Firebase SDK running on my mobile app would use to authenticate to the Firebase server.</p>
  
  <p>Here is what I need help with. I now want a third system, another REST API, that returns private but generic data, but knows nothing about users, to be sent some kind of token that proves its a logged in user originating in my mobile app.</p>
  
  <p>How would I handle that? Is there a way to get a token from the logged in user on my mobile app, pass it to my api and validate it there?</p>