Securely pass current wordpress user to external flask app

I have a Wordpress site with users, and a separate Flask app with logic for responding to Get/Post requests from the WordPress site.

I am able to get the current user into a JavaScript variable on the WP site and send to the Flask app - however how do I ensure that someone cannot pretend to be a different current user, or make this secure to other potential vulnerabilities?

Is there some way of exposing a token or suchlike to JavaScript on the WP side, which then the Flask app can verify, say by using the WordPress API?

from Securely pass current wordpress user to external flask app