Maybe this is a stupid question, but if

[iron orchid]

I'm not super familiar how to do it for entities, but you could essentially send your player's access token to your server and have it validate that they are valid and who they claim to be.