Hi, not sure if this is the right place. Please redirect me if i'm wrong 👍

I am creating a small spotify UI with node.js. Until now i could direct all my client side requests to the node js server which would get/update the access_token if the user was logged in.
The web playback audio player requires an access_token on the client side, which is what i am trying to prevent as much as possible mainly for security reasons.

Can i redirect the callback to the nodejs server which adds the access_token there? Does anyone have any suggestions? The main goal is to not have the access_token on the client. If this is a bad idea, please let me know as well :-)

Thank you!