Server-side access to provider's id token

[tomvoss]

I need to get a provider's id token from an API route in order to proxy it to a remote API as a Bearer token. For the sake of security I wish to use database sessions and I would like to avoid ever sending a provider's id token to the client-side. If I were to ignore the security implications I still could not rely on JWT sessions because they may exceed a browser's cookie size limit.

I can't use the jwt callback to add the id token to the session because it isn't called when configuration option session.jwt is false. While the id token is available in the signIn callback, it's terribly inconvenient to add it directly to the database. Even if I use a custom model and from the signIn callback directly add the id token to the database, getSession filters it out before returning.

What is the best way to retrieve a third-party id token, not save it in a client cookie, and from the server-side fetch data from a remote API while including the Authorization: Bearer <token> header?

In case someone wants to suggest using the provider's access token instead, this does not work because, in my use case, Google uses an opaque non-JWT token that cannot be verified by the remote API (without making a remote HTTP request on every API call).