auth.tsx

// client
signIn().then((user) => {
  axios.post('/users', user, { headers: { authorization: user.accessToken } })
})

// server
server.middleware((req, res) => {
  if (req.headers.authorization) {
    try {
       const decoded = await firebase.verifyIdToken(req.headers.authorization)
       req.uid = decoded.uid
    }
    catch(err) {
      return res.status(401).json({ message: 'Unauthenticated' })
    }
  }
})

server.post('/users', async (req, res) => {
   if (!req.uid) {
      return res.status(401).json({ message: 'Unauthenticated' })
   }
   else {
      // create user in mongo if needed 
   }
})

server.get('/books', async (req) => {
   // return list regardless of auth
})