I have a system that consists of:

A backend in Spring Boot,
A CRUD dashboard (React),
A mobile app (Ionic).

Security is delegated to Keycloak.

The security of my CRUDs is protected since I have users and passwords for the dashboard with their roles, and these are implemented in Spring Boot.

From my backend, I have created an auth section to properly store the secrets so they are not exposed to the client. For example, the dashboard login goes against my backend, and my backend interacts with Keycloak.

The question comes in how to implement it in the app since I want “public” endpoints but, despite being “public,” they should only be accessible by the app.

The challenge is that my app does not handle users, so I don’t have users and passwords.

I can’t think of what type of client to create in Keycloak or how to handle this situation.

I’ve tried to implement a client with authentication type grant_type = client_credentials and have the app perform logins underneath, but this creates a problem/fear for me:

Anyone who has access to the app’s login endpoint will be able to impersonate the app since it doesn’t require a username and password.