How to track device registration tokens?

Here’s what I’m doing:

• Sign the user in with email/password,
• On success, return an API key that is associated with the user,
• Store the API key in the device’s secure storage,
• Send the device token to the backend (authenticate with the API key),
• Fetch the user based on the API key, store the device token,
• When Firebase says the device token is invalid, mark the device token as unregistered (delete it or set a flag).

Great but is it guaranteed that when a device token becomes invalid that it is no longer needed?

I think that when a token becomes invalid, you can throw it away. The mobile app will have to send a new token if the backend wants to push the notifications. See the docs for more details on managing tokens.