# Best Practice for Authorization

**URL:** <https://builder.metamask.io/t/best-practice-for-authorization/1602>\
**Category:** Embedded Wallets (Web3Auth)\
**Created:** [January 16, 2024, 12:03pm UTC](https://builder.metamask.io/t/best-practice-for-authorization/1602 "2024-01-16T12:03:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gorkem](https://avatars.discourse-cdn.com/v4/letter/g/f4b2a3/32.png) [@gorkem](https://builder.metamask.io/u/gorkem)\
**Post date:** [January 16, 2024, 12:03pm UTC](https://builder.metamask.io/t/best-practice-for-authorization/1602/1 "2024-01-16T12:03:42Z")

</div>

> **🏛 Content from Web3Auth Community**
> 
> This topic was originally posted by **gorkem** on 1/16/2024.  
> This content has been migrated from our previous community forum to preserve valuable discussions.

* * *

Hi,

I have an application where I need to check if the user is authorized for some actions in my backend. Is it a good practice to store the app\_pub\_key in my database once the user is logged in and pass the token\_id as an authorization header everytime user makes a request to an api endpoint that requires an authorization? Therefore, I won’t need to pass the app\_pub\_key as the request body everytime user makes a request.

Any comment will be appreciated!

Thanks

---

<div class="post-metadata">

**Author:** ![vjgee](https://avatars.discourse-cdn.com/v4/letter/v/b5e925/32.png) [@vjgee](https://builder.metamask.io/u/vjgee)\
**Post date:** [January 17, 2024, 5:29am UTC](https://builder.metamask.io/t/best-practice-for-authorization/1602/2 "2024-01-17T05:29:59Z")

</div>

@gorkem Your request has been forwarded to our Dev team and we will get back with an update.

---

<div class="post-metadata">

**Author:** ![vjgee](https://avatars.discourse-cdn.com/v4/letter/v/b5e925/32.png) [@vjgee](https://builder.metamask.io/u/vjgee)\
**Post date:** [January 30, 2024, 10:47am UTC](https://builder.metamask.io/t/best-practice-for-authorization/1602/3 "2024-01-30T10:47:04Z")

</div>

@gorkem You can refer to our doc [https://web3auth.io/docs/pnp/features/server-side-verification/social-login-users](https://web3auth.io/docs/pnp/features/server-side-verification/social-login-users) on the best practice.

---

<div class="post-metadata">

**Author:** ![gorkem](https://avatars.discourse-cdn.com/v4/letter/g/f4b2a3/32.png) [@gorkem](https://builder.metamask.io/u/gorkem)\
**Post date:** [January 30, 2024, 11:02am UTC](https://builder.metamask.io/t/best-practice-for-authorization/1602/4 "2024-01-30T11:02:02Z")

</div>

hi @vjgee,

Calling the getUserInfo() or authenticateUser() functions returns the idToken to frontend. Similarly getPrivateKey() function can be used to retrieve the private key of the user in order to compute app\_pub\_key. During these computations, the id\_token and private\_key values are stored inside a variable in my frontend. Is this secure to do so?

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/metamaskbuilderhub/original/1X/082cfc3a14103b01cfa5ef7d85f1121a23fa3e81.png) [@system](https://builder.metamask.io/u/system)\
**Post date:** [February 13, 2024, 11:02am UTC](https://builder.metamask.io/t/best-practice-for-authorization/1602/5 "2024-02-13T11:02:59Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![vjgee](https://avatars.discourse-cdn.com/v4/letter/v/b5e925/32.png) [@vjgee](https://builder.metamask.io/u/vjgee)\
**Post date:** [February 26, 2024, 10:02am UTC](https://builder.metamask.io/t/best-practice-for-authorization/1602/6 "2024-02-26T10:02:59Z")

</div>