Suggest alternative wording:

All tokens received by your server need to be verified unless they were received directly from Google. Any token that you receive via your client apps must be verified.