Apologies if this question is vague.

I’m really looking for guidance on how to implement a backend-for-front end (BFF) using Keycloak and an Angular SSR app.My endgoal is to be able to securely attach a bearer token on the BFF and forward requests to an API.

I have read the document here and understood that ideally I will authenticate on the frontend and pass a PKCE token to the backend server. The backend server then uses the PKCE token and exchanges it for an access token on behalf of the user.

The part I’m struggling with is getting Keycloak, specifically the keycloak-angular library, to return the pkce token, and, how that should be passed to the backend.

Any tips or links to reading material/tutorials would appreciated !

So far I have:

• Setup an angular ssr app and am able to route requests to the backend to proxy them to an API.

• Created a keycloak server running on a Docker image which I have hooked up to my angular app. I created one client for the browser code and a second for the server code. This allows me to login on the angular app and authenticate but I still need to get an access token and securely send it to my API.

• I have an API service-this is where I need to securely send a bearer token.