title: How to store OAuth2 access tokens in php?
body: <p>This is my scenario. The user opens my platform's auth page and then clicks on the <code>Connect to Discord</code> button. The user will allow access from his/her discord account to my application and I get a <code>code</code>. Then I exchange the <code>code</code> for a <code>token</code> with <code>7 DAYS</code> lifetime. I have these problems</p>
  <ol>
  <li>When should I refresh the access token exactly? For example, should I store the creation time of the token somewhere (dB or client), and every time I check if it was close to getting expired, refresh the access token? I don't want to ask the user to log in to discord every 7 days for sure.</li>
  <li>Where should I store the access token for a user? Somewhere on the client-side or the dB? I mean is it secure to store the access tokens on the client-side? Isn't this better to store it for each user on the dB?</li>
  <li>If I want to store the access token on the dB, I should hash it, right? How can I hash the access token and store it on the dB and decrypt it back to the access token for calling the api? (Using PHP)</li>
  <li>Where should I store my application <code>CLIENT_ID</code> and <code>CLIENT_SECRET</code>? I am using these on my <code>PHP</code> file right now. Is it secure?</li>
  </ol>
  <p>Thanks a lot.</p>