# What is the best way to update the accessToken in the app with the new accessToken?

**URL:** <https://community.auth0.com/t/what-is-the-best-way-to-update-the-accesstoken-in-the-app-with-the-new-accesstoken/7161>\
**Category:** Get Help\
**Tags:** nodejs, jwt, access-token, mongo, javascript\
**Created:** [June 21, 2017, 12:29am UTC](https://community.auth0.com/t/what-is-the-best-way-to-update-the-accesstoken-in-the-app-with-the-new-accesstoken/7161 "2017-06-21T00:29:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![15anmy](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@15anmy](https://community.auth0.com/u/15anmy)\
**Post date:** [June 21, 2017, 12:29am UTC](https://community.auth0.com/t/what-is-the-best-way-to-update-the-accesstoken-in-the-app-with-the-new-accesstoken/7161/1 "2017-06-21T00:29:29Z")

</div>

##Before getting to the actual question  
Alright I have created my own authentication system that I am going to use on my API.

**Simple explanation:**  
  
On `/signup` the user types in username, password etc… the API grants the user with `tokens` which are stored in the user document in the database. The API also returns with a response body with the new `refreshToken` and `accessToken`, my thought here is so the app easily can store the tokens on the phone for later calls to the API.

`/login` is pretty much the same thing except you only provide username and password.

One of the routes in the API is the `/article` which you can `GET` & `POST`.

Now if you try to for example `GET` the `/article` and your `accessToken` is expired the API will automatically call `/token` which requires the `refreshToken` in the header, the `/token` will then grant you a new `accessToken` and request the same route you were trying to get (in this case `/article`) with the new `accessToken` in the header.

**The question** :  
What is the best way to update the `accessToken` in the app with the **new** `accessToken`?

```
router
  .route('/article')
    .get(
      AuthenticateController.authenticate,
      NewsController.getAllArticles,
      AuthenticateController.sendAuthorize
);

```

This is how I do it now, `AuthenticateController.authenticate` authenticates the accessToken and checks if it is expired and all that then calls `next()`.

The `NewsController.getAllArticles` gets all the articles and also calls `next()` so the `AuthenticateController.sendAuthorize` can run and return the new `accessToken` in the response header when a new one is granted (I thought this would make it easier to obatin the new token in the app). This is where my question comes in because I can’t call `next()` on every route because on some routes the main function already returns a response and that means that `next()` cannot be called which means `AuthenticateController.sendAuthorize` will never run. I want the `AuthenticateController.authenticate` to be the only middleware required to authenticate the user.

---

<div class="post-metadata">

**Author:** ![15anmy](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@15anmy](https://community.auth0.com/u/15anmy)\
**Post date:** [June 21, 2017, 12:48am UTC](https://community.auth0.com/t/what-is-the-best-way-to-update-the-accesstoken-in-the-app-with-the-new-accesstoken/7161/2 "2017-06-21T00:48:12Z")

</div>

**Peter Kazazes told me this on stackoverflow which worked out:**  
  
Instead of waiting until the last route to send the new token, you should move the sendAuthorize middleware above the route’s main response (or combine it with authenticate), and instead send a 401 Unauthorized response with the new token. Then, update the token on the client and resend the request.

It seems like a silly practice to send a valid response with an invalid accessToken anyway. You’re going to want to invalidate tokens eventually (I.e on log out or password change), and you don’t want users to be able to make unauthenticated requests.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 2, 2018, 5:54am UTC](https://community.auth0.com/t/what-is-the-best-way-to-update-the-accesstoken-in-the-app-with-the-new-accesstoken/7161/3 "2018-03-02T05:54:48Z")

</div>