# What's the best way to save the access token in MongoDB? **URL:** \ **Category:** API\ **Created:** [August 5, 2023, 3:58pm UTC](https://discuss.dev.twitch.com/t/whats-the-best-way-to-save-the-access-token-in-mongodb/46779 "2023-08-05T15:58:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![becker135](https://avatars.discourse-cdn.com/v4/letter/b/a587f6/32.png) [@becker135](https://discuss.dev.twitch.com/u/becker135)\ **Post date:** [August 5, 2023, 3:58pm UTC](https://discuss.dev.twitch.com/t/whats-the-best-way-to-save-the-access-token-in-mongodb/46779/1 "2023-08-05T15:58:11Z")
Hi community! I’m currently in the process of developing a MERN stack app that is connected to a MongoDB database, and will allow users to connect their twitch users to their accounts so they can add the followers count they have as part of the profile data. The way I’ve managed to do this is the following: POST request to “[https://id.twitch.tv/oauth2/token](https://id.twitch.tv/oauth2/token)” to get the access token GET request to “[https://api.twitch.tv/helix/users](https://api.twitch.tv/helix/users)” to get userinfo (mainly user id) GET request to “[https://api.twitch.tv/helix/channels/followers?broadcaster\_id=${id}](https://api.twitch.tv/helix/channels/followers?broadcaster_id=$%7Bid%7D)” to get the total amount of followers. So my questions are the following: After receiving both the access\_token and refresh\_token, what would be the best way to save this data? Should I save both the refresh token and access token as part of the user data in the User model I’ve created on MongoDB, so I can use the refresh token to generate a new access token when it expires? Would using 3 HTTP requests as I’ve done be the correct way to do this? Or there would be a most efficient way? Any guidance on this would be greatly appreciated. Thanks in advance! ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [August 5, 2023, 3:59pm UTC](https://discuss.dev.twitch.com/t/whats-the-best-way-to-save-the-access-token-in-mongodb/46779/2 "2023-08-05T15:59:34Z")
> [@becker135](#): > > Should I save both the refresh token and access token as part of the user data in the User model I’ve created on MongoDB, so I can use the refresh token to generate a new access token when it expires? Sounds sensible to me > [@becker135](#): > > Would using 3 HTTP requests as I’ve done be the correct way to do this? Or there would be a most efficient way? What you did sounds good to me. There is no changes I would make. ---
**Author:** ![becker135](https://avatars.discourse-cdn.com/v4/letter/b/a587f6/32.png) [@becker135](https://discuss.dev.twitch.com/u/becker135)\ **Post date:** [August 5, 2023, 4:00pm UTC](https://discuss.dev.twitch.com/t/whats-the-best-way-to-save-the-access-token-in-mongodb/46779/3 "2023-08-05T16:00:50Z")
Thanks, I was thinking about hashing the access tokens before saving them in the database. Do you think that would be a good way to do it so I can retrieve the followers count every time users access my app? ---
**Author:** ![BarryCarlyon](https://d3ovvz0v2ajtpu.cloudfront.net/user_avatar/discuss.dev.twitch.com/barrycarlyon/32/253_2.png) [@BarryCarlyon](https://discuss.dev.twitch.com/u/BarryCarlyon)\ **Post date:** [August 5, 2023, 4:04pm UTC](https://discuss.dev.twitch.com/t/whats-the-best-way-to-save-the-access-token-in-mongodb/46779/4 "2023-08-05T16:04:45Z")
No need to hash imo, since if you get breached they’ll probably nab the code to which describes how to unhash it since you need to unhash for use. A given access token is only valid for 4 hours (using code flow) If the access token is leaked can’t do anything with it if it’s 4 hours old. and so far you only are reading public data, so you can’t do much with the token. The refresh token is only useful if an attacker also aquires your client secret. and if you reset your leaked client secret then all the access tokens die after 4 hours and all the refresh tokens are useless the moment you reset. So hashing is unneeded in my opinion. Follow counts can also be pulled using _any token_ So depending what you are doing you might not even want to store user tokens are all. After the user signs up to your service you jsut store their username/ID in your database, and you can everything else with an App Access Token that is used only in real time/running memory not stored in the database. ---
**Author:** ![becker135](https://avatars.discourse-cdn.com/v4/letter/b/a587f6/32.png) [@becker135](https://discuss.dev.twitch.com/u/becker135)\ **Post date:** [August 5, 2023, 4:08pm UTC](https://discuss.dev.twitch.com/t/whats-the-best-way-to-save-the-access-token-in-mongodb/46779/5 "2023-08-05T16:08:08Z")
Got it. I think that’s what I needed to confirm Thanks a lot! ---
**Author:** ![system](https://d2opxh93rbxzdn.cloudfront.net/original/2X/0/05909729875cce3b53e59d5561c4d23bb14948fc.png) [@system](https://discuss.dev.twitch.com/u/system)\ **Post date:** [September 6, 2023, 11:05am UTC](https://discuss.dev.twitch.com/t/whats-the-best-way-to-save-the-access-token-in-mongodb/46779/7 "2023-09-06T11:05:45Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.