I use the code below to obtain a token from firebase :
const messaging = firebase.messaging();
messaging.requestPermission()
.then(() =>{
return fi
Firebase Cloud Messaging tokens identify an installation of an app in a specific device. They do not identify a specific user. So in your case, if multiple users access your app in the same browser profile, they will get the same token.
I haven't tried this myself, but I think you can delete the token (typically when the user signs out). Then request permission and get the new token for the new user, as usual.