Comment by BeyondLimits99

If you're using JWTs for authentication.

It's considered insecure to store them in local storage for XSS etc

Where / how are you storing them locally for headless apps?