Even I wouldn't recommend generating your bearer tokens client side if they are actually doing it, but collision thing is a bit far fetched. Any randomly generated UUID like UUID4 has a randomness in space of 2^122(ignoring pre determined bits). For practical purposes this is almost unique, you will need to generate ~2^61 ids for 0.5 probability of a collision happening.