# M2M token storage **URL:** \ **Category:** Get Help\ **Tags:** m2m, jwt, m2m-tokens\ **Created:** [August 9, 2020, 9:34am UTC](https://community.auth0.com/t/m2m-token-storage/47701 "2020-08-09T09:34:59Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ryangoy](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ryangoy/32/14179_2.png) [@ryangoy](https://community.auth0.com/u/ryangoy)\ **Post date:** [August 9, 2020, 9:34am UTC](https://community.auth0.com/t/m2m-token-storage/47701/1 "2020-08-09T09:34:59Z")
I’m using M2M tokens for other backend servers to directly access my API by issuing tokens through the client credentials grant. The backend server will use this token to access my API servers times over the next 12 hours. What is the best way for them to store this token? I see many articles describing how to save these tokens on client side, but what is the best practice for M2M tokens? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [August 12, 2020, 5:16pm UTC](https://community.auth0.com/t/m2m-token-storage/47701/3 "2020-08-12T17:16:51Z")
Hi @ryangoy, Welcome to the Community! I don’t think we have much guidance on this. I am going to reach out to the team and see what they recommend. What framework are you using? ---
**Author:** ![ryangoy](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ryangoy/32/14179_2.png) [@ryangoy](https://community.auth0.com/u/ryangoy)\ **Post date:** [August 12, 2020, 9:36pm UTC](https://community.auth0.com/t/m2m-token-storage/47701/4 "2020-08-12T21:36:20Z")
Hi @dan.woda, Thanks for the welcome 🙂 I am using Node.js for the backend, run on AWS Lambda. I have the developer pro plan, so I received an answer from support. There were two options provided: (1) I could switch over to using a Password Grant [[Call Your API Using Resource Owner Password Flow](https://auth0.com/docs/flows/call-your-api-using-resource-owner-password-flow)], or (2) I could cache tokens on my backend and essentially wrap the /oauth/token endpoint. I believe option (2) would require me to validate the M2M key pair on my own in the case I return a cached access token, so I’m going with option (1) for now. I’ll update when I get a solution working! ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [August 12, 2020, 9:38pm UTC](https://community.auth0.com/t/m2m-token-storage/47701/5 "2020-08-12T21:38:14Z")
Thanks for the update! ---
**Author:** ![ryangoy](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ryangoy/32/14179_2.png) [@ryangoy](https://community.auth0.com/u/ryangoy)\ **Post date:** [August 12, 2020, 11:08pm UTC](https://community.auth0.com/t/m2m-token-storage/47701/6 "2020-08-12T23:08:40Z")
@dan.woda I’m trying to get a refresh token to display to the user so they can fetch access tokens in backend to backend call. I’m using this guide [Get Refresh Tokens](https://auth0.com/docs/tokens/refresh-tokens/get-refresh-tokens) In the first section, a parameter I’m not sure what to do with is state={OPAQUE\_VALUE}. What should I be inputting for that? ---
**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\ **Post date:** [August 13, 2020, 4:50pm UTC](https://community.auth0.com/t/m2m-token-storage/47701/7 "2020-08-13T16:50:27Z")
@ryangoy, The state param is \* a unique and non-guessable value associated with each authentication request\*. It can be an encoded piece of information, or a random nonce. This doc explains its usage: > **[Prevent Attacks and Redirect Users with OAuth 2.0 State Parameters](https://auth0.com/docs/secure/attack-protection/state-parameters)** > > Describes how to use the state parameter in authentication requests to help prevent CSRF attacks and restore state ---
**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\ **Post date:** [August 28, 2020, 4:58pm UTC](https://community.auth0.com/t/m2m-token-storage/47701/8 "2020-08-28T16:58:25Z")
This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.