I'm trying to implement authentication via Google/Facebook in my Android application, but I can't figure out how to verify if a request sent to my back-end server really come from an authenticated user.

I'll try to explain.
When I'm using a more classic way, like login/password, to authenticate users, I just need to check the credentials on the server side and return a token.
On the next requests, I simply add the token to it and my server can verify that the token is valid for the user who made the request.

When I'm using external login like Google or Facebook, the user is clearly authenticated on the client side by the corresponding SDK, but my server doesn't have any information about this authentication : I don't have a token known by both sides.
If I call a service with just the user id returned by OAuth2 authentication, I don't have security at all. Anybody can call my service with a random id and get some informations about my users.

I'm probably missing something simple in the process, but after searching for hours for a solution, I haven't found a good explanation.

If I add a service returning a token when registering the user id, anybody can call it and get a token, so this is not more secure...

I can add an app token to check that this is my app which is calling the service. This is a little more secure but anybody can reverse engineer my app to find the token...

Thanks for your help.