在哪里安全地存储用于来自 Monzo 银行 api 请求的 api 请求的访问令牌

Question

I am working on a finance app using the Monzo bank api, and the auth process ends in receiving an access_token from the Monzo api: https://docs.monzo.com/#acquire-an-access-token

I have got to this point, and received the token which I need to use to make all future api requests to retrieve my financial data, but I am really unsure how to securely store this token.

Localstorage is not secure, so where could I store it so it can't be read from the client side?

This is within a React app using Firebase as the database.

Many thanks

Answer 1

You can use HTTPonly or Secure Cookies to store the token

To Setup Cookies with reactJS there is a package

https://www.npmjs.com/package/react-cookie

Answer 2

If you have an API key that must be kept secret from the users of your app, you'll want to keep that API key on the server, and only expose the specific functionality to that user that they're allowed to use.

My preferred way to write such a server-side endpoint/API is by using Cloud Functions for Firebase . If you want to get started with that, I recommend taking this codelab .