it should be going through your backend service, so if you are passing it to your frontend, you can place it into something like a JWT