I work as an IT Security professional (IT Auditor), so can answer from experience.
First, I will define a secure token. In order for the access token to be secure: you would need to satisfy the below:
- Token expires at some point
- Token cannot be modified in transit between client and server.
- User cannot modify the token.
Token expires at some point
This requirement is the easiest. You specify a date when this token will no longer be valid, on the server side. If date of the login > expiration date of the token, then reject the token as having expired.
Token cannot be modified in transit between client and server
As you are using TLS, (hopefully version 1.2 and updating to 1.3 when finalized) this problem should be resolved already. TLS provides confidentiality, ensuring that the access token is not disclosed without authorization to a third party.
User cannot modify the token
This requirement is the most difficult. To accompanist this, you would need to use a digital signature with PKI. Do not use SHA 1 as the hashing function because this algorithm is INSECURE. Applying the hashing function to the access token results in a message digest. The message digest is then encrypted using the private key that only the user knows. Once the credential are decrypted on the server using the public key of the user, if the resulting message matches the credentials on the server, then it is guaranteed that no modification of the access token by the user took place.
The above method guarantees the C - confidentiality, and I - Integrity requirements of the security CIA triad. Non-repudiation (user cannot deny it is his credentials) is also guaranteed due to the public key of the user being able to decrypt the encrypted message received.
To answer some of your other questions:
Should I encrypt the access token locally when stored?
Yes you should. The above pertains to data in transit, but not at rest. If a hacker were to compromise the local client machine, he or she can easily steal a plaintext token, and then impersonate the rightful owner.
How should I encrypt?
You should use a strong encryption algorithm such as AES or RSA. Chose a long key length (ex: 256) to maximize security.