If that is done through the backend then yes, you can. Just have a simple unsigned big int for your user_id column if the data is scoped to a user without a foreign key. Also just create a middleware that will check for the user and if you get a bad response don't allow the user to progress to the next middleware.
That is the simplest way I could think of at the moment.