# Authentication flow - how it works, am I getting it right? **URL:** \ **Category:** Get Help\ **Created:** [January 19, 2021, 10:20am UTC](https://community.auth0.com/t/authentication-flow-how-it-works-am-i-getting-it-right/56422 "2021-01-19T10:20:23Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![alt1](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/alt1/32/13075_2.png) [@alt1](https://community.auth0.com/u/alt1)\ **Post date:** [January 19, 2021, 10:20am UTC](https://community.auth0.com/t/authentication-flow-how-it-works-am-i-getting-it-right/56422/1 "2021-01-19T10:20:23Z")
_Authentication flow. Let’s say I don’t need access\_token to make queries to some API._ Options: **1.** I am using React. I press login button, I being redirected to Auth0 server to enter email and password, I type them in, I am being redirected back to callback url in my app. As extra param I get access token. It is indicator that I was authorized. Now I can see protected pages in my app. What exactly should I do on callback page with access\_token? **a)** I see that it exists, I save flag ‘isLoggedIn’ to store? Then on each protected page I check it before render? But this is just data in redux store, I guess it is possible to easily hack it and change flag, am I right? **b)** I save access\_token to… somewhere? Where? In one tutorial you say it is unsafe, don’t do it, in another you suggest to save access\_token in local storage. What to do? Can you give direct and ready to use answer, please? And what should I do with that token after I save it. **c)** Or maby I don’t need to save token at all. Should I use some method to check token validity (aka checkSessionOnAuth0Side() ) in root component each time some rerender happens? **2.** And the second part of question reffered to API. This is how I did authentication and authorisation (but looks that something is broken now, I get errors). My apologise for dirty code. It is not working as an application (you may close browser immediately), it is just code, the most important part for you could understand conception. _Is it correct, am I do it a right way, can I use it? Look at the code, please._ [Codesandbox](https://codesandbox.io/s/billowing-darkness-4hhx2?file=/src/index.js) ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [January 19, 2021, 8:43pm UTC](https://community.auth0.com/t/authentication-flow-how-it-works-am-i-getting-it-right/56422/3 "2021-01-19T20:43:05Z")
Hi @alt1, You should check out our React SDK. It takes care of these decisions for you. It will cache the access\_token in memory, then retrieve it if it exists and is not expired, or requests a new one via silent authentication if your user has refreshed the page or the token is expired. Either way, these decisions are made by the SDK and you don’t have to worry about it. Here is a link to our react quickstart: > **[Auth0 React SDK Quickstarts: Login](https://auth0.com/docs/quickstart/spa/react/01-login)** > > Auth0 allows you to add authentication to your React application quickly and to gain access to user profile information. This guide demonstrates how to integrate Auth0 with any new or existing React application using the Auth0 React SDK. ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [February 12, 2021, 6:21pm UTC](https://community.auth0.com/t/authentication-flow-how-it-works-am-i-getting-it-right/56422/4 "2021-02-12T18:21:36Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.