Saving a token in Oauth 2.0?

Question

OAuth

Do not quite understand. HERE is a web application successfully received a token (Dropbox api). You can call methods with a token and get the necessary information. And where does the token itself go? Now I save it in localstorage and pull it out when initializing the application, of course, this is not fucking safe, can it be in the database? Or just ask the user each time to allow access to the application (waste your time on this, and the old token, in the meantime, may still be valid.)