I think you’re better off keeping the auto increment PK then expose a uuid token anywhere it can be viewed.

You probably don’t want to be literally passing around the literal primary key if you are concerned about leaking security information.

But I think it’s probably better so the user id being known is not a problem. For example, not caring if people know how users/widgets/whatever.