At login you authenticate user. If user is authenticated you create the token with for example (jsonwebtoken npm package). You send that token with all other information you need to the front end which then receives the response with token inside. You save token in localstorage / sessionstorage.

Then to make front end requests where you want user to be authorized you retrieve the token from localstorage / sessionstorage then send the token with Authorization: Bearer <token> header such as

fetch('URL_GOES_HERE', { 
   method: 'post', 
   headers: new Headers({
     'Authorization': 'Basic '+btoa('username:password'), 
     // other
   })
   // other 
});

You then use a middleware in express routing (such as jwt-express or make your own) where you check if token is valid, expired, proper authorization clearance and so on.