title: Proper way to authenticate with a backend server
body: <p>According to the <a href="https://developers.google.com/identity/sign-in/android/backend-auth#send-the-id-token-to-your-server" rel="nofollow">doc</a>, in order to authenticate with a backend server I have to : </p>
  
  <ul>
  <li>send the user's ID token to my server using HTTPS. </li>
  <li>verify the integrity of the ID token and retrieve the user's ID from the sub claim of the ID token. </li>
  </ul>
  
  <p>This work quite well, but how to do if I have to authenticate all the request to the server ? </p>
  
  <p>Should I store the idToken (on a private sharred preferences) and verify it each time server side ? Since the idToken have a validity date, the client must be able to regenerate it when it has expired.</p>
  
  <p>Or on the first connection, should I return a single id (without validity date) to the user which will allow him to communicate with the server (seems less secure) ?</p>