To maximize security, it is recommended to combine the refresh token with the access token following the JWT standard. Failure to do so may result in compatibility issues with other programs and APIs.
It is also a good idea to refresh your token with each API request, rather than waiting until it is close to expiration.
While I'm not certain if this approach is considered best practice, I personally implement it in one of my Node Services. You can view the code here:
https://github.com/username/service/blob/master/src/api/Service.tsx#L74 (client)
https://github.com/username/service/blob/master/sync/src/index.ts (server)
Edit:
If you wish to merge both tokens into a single "token", you could potentially utilize the following implementation:
client
const authentication = {
accessToken: "your accesstoken...",
refreshToken: "your refreshToken...",
action: "getBlogPosts"
};
const data = btoa(authentication) // converting to ASCII String
api.post('/auth', data).then(result => {
if (result.status === 200) {
console.log('Authentication successful')
} else {
console.log('Invalid credentials')
}
})
server
api.post('/auth', (request, response) => {
const data = atob(request.data);
if (jwt.verify(data.accessToken)) {
this.action = data.action;
switch (data.action) {
case "getBlogPosts": //...perform necessary actions
...
...