How to store bearer token in wordpress?

Question

I have an external API that I am sending data to from my Wordpress Form to register users. Upon registration, the API sends back a Bearer Token which I need to use to make an additional request to the API from another page.

Currently in my functions.php , I am using wp_remote_post to get the bearer token from the API. The token has an expiry time from the server side, but I can't seem to find the correct way to store it so I can make an additional request on another page. Is it a good idea to just store it in a $_SESSION global variable or is there a proper way of doing this?

Thanks

Answer 1

First of all, no - do not use PHP sessions. In short, PHP sessions are a bad idea in terms of caching and performance. You can easily find more extended explanations on Google.

You can store bearer and/or refresh tokens in the database. There are some possible concerns like "if someone gets access to the database, they get the access to all security tokens", but, however, if someone got access to your database - everything is already bad.