title: Security issue with verifying firebase token on server side?
body: <p>I am using firebase mobile otp authentication. After successful authentication my android app receives a token which I have to verify on my django server. But while I was reading the docs of verifying this token, it comes out that if someone knows my firebase project-id, they can generate valid tokens anytime they want.</p>
  
  <p>To get contec, look at the last method to verify firebase token at <a href="https://firebase.google.com/docs/auth/admin/verify-id-tokens" rel="nofollow noreferrer">link</a></p>
  
  <p>Isn't this quite risky, as once your firebase project id is known to someone, they can create fake tokens??</p>
  
  <p>Also does custom authentication token help overcome this problem?</p>
  
  <p>Thanks. Let me know if I have incorrectly understood the firebase token validation and it is not possible to create fake tokens once we know the firebase project-id.</p>