I have a REST API which returns an auth token when the user is logged in successfully. This token needs to be sent in different routes for authorisation. This is working fine is my android app. But I want to use this is my website and I am not sure how should I be storing auth token in browser securely .
Cookies with a MUST of "httponly" and "secure" attributes are the only secure way forward. This is because in a scenario of a XSS (Cross Site Scripting) attack LocalStorage or the DOM data can be easily read by the attacker.
This would of course depend on the architecture of your application. Auth0 has a good article explaining different ways to store tokens.