This depends a little bit on where you're calling the search API from. Ideally you call it from your own backend (or from an API route or Server Function in Next.js if that's what you're using)

In that case, the safest way is to save the access token in a cookie with HttpOnly=true and SameSite=Strict headers. That will keep the access token attached to the browser of the user who requested it (so no one else can access) and only accessible in your server (so no client side code can read the cookie value)

Browsers send cookies to the backend automatically on each request, so you can use req.cookie to access the value in your server handler. You can also make this cookie expire automatically after an hour so you don't need to check it yourself.

Hey @umamaheshdiddi! 👋

Just checking in on this thread. If you're still experiencing issues or have additional details to share, please let us know! We're here to help.