How to securely generate a session token that can be independently verified by Auth instances

I'm currently working on making an authentication gRPC microservice using Rust and Tonic. The simple idea is that my service generates a token that can later be used to reference back to the UserID. I save this token and user relationship in a redis database so I can run multiple of these authentication services in tandem. I'm currently generating my tokens like this:

// Create a session for a username
pub fn create_session_id(username: &String) -> String {
    // Generate unique ID
    let id = Uuid::new_v4();

    // Hash the ID and username for a unique session token
    let mut hasher = Sha256::new();
    hasher.update(id.to_string() + username);

    // Return hexadecimal string encoding of hash
    format!("{:X}", hasher.finalize())
}

I will be the first to admit it's a bit primitive. My problem is that there's nothing stopping a potential attacker with access to this database from inserting their own arbitrary token with an associated userid. This means I will have to be able to verify my token came from my authentication service. How do I generate a session token that can be independantly verified by any one of my auth instances without making it vunerable to forgery.

I have thought about implementing OAuth2, but I'm struggling to integrate that with the gRPC microservice architecture.

Any help would be appriciated.