Server side API calls - how to persist a token

[woeful mist]

I know that in order to keep an .env secret and make an API call, it can be done via the api routes' handlers and make the API call server side, then return the reply to the client.

If the API call is authenticated, then a token needs to be obtained at the server side from a handler and then the API call can be made.

How can this token be kept secret and be reused across handlers to make multiple API calls from the server side?

[gray widget]

I believe same .env file or vercel environment variables can be accessible from server side as well. Have u tried that?

[sick mango]

What is the token used for? client side calls or server side only?

[gray widget]

For both, i guess

[woeful mist]

server-side only

I mean that the goal is to use an env secret, then obtain a token by using that secret and then make calls using that token