Can I crate an initial record in a database, then update it?

I'm trying to create a User document in MongoDB. The User is composed of name, phone (from frontend form) and spotify_id and spotify API access tokens. I want to avoid exposing my tokens to the frontend at all costs. I currently, store the form data (name+phone) in a cookie and then once the access token is retrieved in the backend from spotify, I create a DB document with the form data and spotify data. This feels weird as I'm creating a User in the DB from a GET("/sign-up") in the frontend. I want to follow best practices and some RESTfulness. I was considering first creating User in DB with only spotify_id and token once authorized and then after auth, calling POST or PUT from the frontend with the formdata to add to this document to complete the User. What would be the best way of going about this? I'm really struggling to find a consistent and concise approach.