Well I just searched Angular dev and started scrolling through the list of posts

I wouldn’t change the JWT you originally sent to the client. I would store the auth info from your third party API in a db and just reference it server side when requests come in using it.

It is okay to do this, but I recommend fetching the third party API JWT via your API that way you can sanitize the data on your server and avoid forcing the client to make extra requests.