We have an app then a Cloud Function as well that serves HTTP request. To secure and target the user data, we used the token generated from client/app then use it as a query par