I've been tasked with finding a new auth provider at work and am looking at Firebase Auth. Our use-case is pretty standard (login via website, OIDC from Azure AD), which Firebase seems to do just fine. My question is about backend security.

We also serve an API that currently accepts either short-lived or long-lived tokens. Short-lived is generated via a POST route and has a lifetime of 1 hour, whereas long-lived lasts forever and is generated manually on a per-need basis. The best I can find in Firebase is creating custom tokens, which fulfill the short-lived portion but not long-lived. Is there something that can offer this functionality?