title: Facebook OAuth in Node.JS: storing the access token
body: <p>I'm implementing a backend which interacts with Facebook, using the OAuth API. Firstly, I exchange an authorization code for an access token:</p>
  
  <pre><code>var accessTokenUrl = 'https://graph.facebook.com/v2.3/oauth/access_token';
  var params = {
      code: req.body.code,
      client_id: req.body.clientId,
      client_secret: config.FACEBOOK_SECRET,
      redirect_uri: req.body.redirectUri
  };
  request.get({
      url: accessTokenUrl,
      qs: params,
      json: true
  }, function(err, response, accessToken) {
      ...
  });
  </code></pre>
  
  <p>I'll be needing that access token for feature requests to the Facebook API (requesting profile information, posting to timeline etc.), so I need to store it somewhere server-side. Can I do this just by doing this:</p>
  
  <pre><code>exports.access_token = access_token;
  </code></pre>
  
  <p>In other words, is exports.access_token unique for every connection with Node.JS, or is this variable shared by all clients (in which case I could absolutely not do this)? </p>
  
  <p>I also use JSON web tokens, so I could also do this after requesting the token:</p>
  
  <pre><code>function createToken(accessToken) {
      var payload = {
          sub: accessToken,
          iat: moment().unix(),
          exp: moment().add(14, 'days').unix()
      };
      return jwt.encode(payload, config.TOKEN_SECRET);
  }
  </code></pre>
  
  <p>For using the token for feature requests, I could simply do:</p>
  
  <pre><code>var token = req.headers.authorization.split(' ')[1];
  var payload = jwt.decode(token, config.TOKEN_SECRET);
  var accessToken = payload.sub;
  </code></pre>
  
  <p>Or is this not advisable either? The reason I would use the JSON web tokens, is because I use Satellizer, which uses this be default.</p>