oauth - Node.js - How to use access / auth tokens? -

i have built first node.js app supposed installed on shopify store. if want see actual code looks (app.js) can view here. it's basic reading through won't hard.

i know how authenticate installation of app (following shopify instructions) i don't how authenticate subsequent requests using permanent access token successful installation provides me with.

by subsequent requests i'm referring requests either render app or requests install app, though app installed.

right now, i'm storing shop's name (which unique) along permanent token shopify sends me in database. don't know if that's necessary. if i'm not mistaken, simply using browser's session ? how do ? , how use token every time request comes through check if valid one?

thank help/suggestions!

the code below sort of representation of my actual code looks in order give idea of issues :

db.once('open', function(callback) {      app.get('/', function (req, res)    {       var name = getnamefrom(req);        if (existsindb(name) && tokenexistsindbfor(name))       {          res.redirect('/render');           /*             checking shop (along permanent token)             exists in db enough ?             shouldn't check whether current request comes              token equal 1 in db ?             if token received request different                    1 stored in db ?          */        }       else res.redirect('/auth');    });     app.get('/auth', function (req, res)    {           if (authenticated(req))       {           var token = getpermanenttoken();            storeitindb(namefrom(req), token);           res.redirect('/render');            /*             aren't supposed more              token i've received ? send             back/store in browser session maybe?             storing in db necessary ?           */       }    });      app.get('/render', function (req, res)    {          /*       how check request coming        authorised shop has necessary token ?       checking db not        because there might inconsistency correct ?       */        res.sendfile(*file build app on client*);    }); }); 

getting access token shopify once time process.

save access token , shop's name in db, , generate , save 'auth token' based on algorithm. return generated auth token client. make sure client sends auth token in every request.

now when client hit server verify auth token; once verified make call shopify api using appropriate 'access token' , shop name.

authentication flow follows:

• get access token shopify
• generate token(i refering auth token) shopify shop, refer this
• now save shopify's access token, shopify store name , generated token db
• now send generated token client(save in cookie or local storage)

validation flow:

• clients hits server data auth token
• verify auth token in db, , access token , shop name auth token
• now make calls shopify api using access token , shop name

hope method helps