I’m looking to protect tokens issued from my identity provider using the BFF pattern(.with .NET Maui as the client and YARP as the BFF).

There doesn’t seem to be any guidance out there in terms of whether/how we can achieve this on .Net Maui (most of the samples do directly get the token delivered to the device and persist it somewhere like using the Secure Storage API).

I’m aware that Maui has a web authenticator to handle browser based flows so wondered if it was possible to have the web authenticator handle the front channel/login interactions with the BFF (once authenticated the Web Authenticator could then call a BFF endpoint for the claims with the attached cookie) and then use http client to deal with requests proxied through YARP for access to protected APIs.