Use express-session to track cookies for when a user logs in, and page redirects. API tokens will not be enough as this only protects the API, not the dashboards.
If a user goes directly to their dashboard, those routes need to be redirected if the user is not logged in.
A user should be able to bookmark the dashboard at any point and always be able to return to that point.