Your React app should never hold an auth token

Access tokens in JavaScript are readable by any script on the page. A thin backend-for-frontend removes the problem instead of managing it.