title: Should I make 3rd party API calls in backend or frontend?
body: <p>I have an API and that API needs some data from the Microsft Graph API. I was thinking of implementing an endpoint in my API to refresh the token and use that token to make calls from the frontend. I don't know if that's optimal or safe, hence my question.</p>
  
  <p>EDIT 1: To give a better perspective of what I have, this is the logic I have at the moment. Tell me if this is correct please.</p>
  
  <p>User requests my API's authorization endpoint, which has the Azure's secret key, then the user is redirected to the Microsft oAuth login page. Once logged in oAuth, Microsoft redirects the user to my API, where it saves the JWT tokens in the user's cookies, so the user can refresh the token anytime.</p>
  
  <p>In order to refresh the token, the user simply just makes a call to <code>myapi.com/auth/microsoft/token</code>, where it has the secret key, and it refreshes.</p>