How to secure the access token?

[Garamani]

currently, I'm sending the access token from the server to only logged-in users but, I feel this approach is not ideal and actually might be dangerous do you have any suggestions on how to secure the Mapbox access token?

[mattijsf]

I think you're doing it quite safe already. This way a compromised token can be renewed. You could add a layer of encryption to decrypt the keys on the client. But I the end, if someone wants to, the token can be obtained.

What are you most worried for?

[mattijsf]

Oh and make sure you're using https to connect your server, but I hope/assume it already is 🤞

[Garamani]

Hi @mattijsf, Thank you for your quick response 🙏

What are you most worried for?

• I'm using HTTPS
• I changed the method from GET to POST
• and the Access Token only is sent to the app with logged-in users to make sure the URL is not accessible for some attacker outside the app.

I was worried because I'm sending this sensitive data over the Internet and wanted to make sure that what I'm doing is safe. now that someone with more experience confirms it I'm less worried. Thanks again