Hey @sshaw, the best way to manage this is with online access tokens. When you use this, the access token is linked to the individual logged in user.
Online access is meant to be used when a user is interacting with your app through the web, or when an app must respect an individual user’s permission level.